Guide to the Secure Configuration of Red Hat Enterprise Linux 9
https://www.open-scap.org/security-policies/scap-security-guide
scap-security-guide package which is developed at
https://www.open-scap.org/security-policies/scap-security-guide.
Providing system administrators with such guidance informs them how to securely configure systems under their control in a variety of network roles. Policy makers and baseline creators can use this catalog of settings, with its associated references to higher-level security control catalogs, in order to assist them in security baseline creation. This guide is a catalog, not a checklist, and satisfaction of every item is not likely to be possible or sensible in many operational scenarios. However, the XCCDF format enables granular selection and adjustment of settings, and their association with OVAL and OCIL content provides an automated checking capability. Transformations of this document, and its associated automated checking content, are capable of providing baselines that meet a diverse set of policy objectives. Some example XCCDF Profiles, which are selections of items that form checklists and can be used as baselines, are available with this guide. They can be processed, in an automated fashion, with tools that support the Security Content Automation Protocol (SCAP). The DISA STIG, which provides required settings for US Department of Defense systems, is one example of a baseline created from this guidance.
Evaluation Characteristics
| Evaluation target | localhost |
|---|---|
| Benchmark URL | #scap_org.open-scap_comp_ssg-rhel9-xccdf.xml |
| Benchmark ID | xccdf_org.ssgproject.content_benchmark_RHEL-9 |
| Benchmark version | 0.1.66 |
| Profile ID | xccdf_org.ssgproject.content_profile_cis_server_l1_hsmauth |
| Started at | 2023-07-10T14:09:58+05:00 |
| Finished at | 2023-07-10T14:11:29+05:00 |
| Performed by | inx |
| Test system | cpe:/a:redhat:openscap:1.3.7 |
CPE Platforms
- cpe:/o:redhat:enterprise_linux:9
Addresses
- IPv4 127.0.0.1
- IPv4 192.168.18.47
- IPv6 0:0:0:0:0:0:0:1
- IPv6 fe80:0:0:0:20c:29ff:feb3:fab4
- MAC 00:00:00:00:00:00
- MAC 00:0C:29:B3:FA:B4
Compliance and Scoring
Rule results
Severity of failed rules
Score
| Scoring system | Score | Maximum | Percent |
|---|---|---|---|
| urn:xccdf:scoring:default | 72.302406 | 100.000000 |
Rule Overview
Result Details
Install AIDE
| Rule ID | xccdf_org.ssgproject.content_rule_package_aide_installed |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_aide_installed:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-90843-4 References: BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-002696, CCI-002699, CCI-001744, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, 1034, 1288, 1341, 1417, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000445-GPOS-00199, 1.3.1 |
| Description | The aide package can be installed with the following command:
$ sudo dnf install aide |
| Rationale | The AIDE package must be installed if it is to be available for integrity checking. |
package aide is installed oval:ssg-test_package_aide_installed:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_aide_installed:obj:1 of type rpminfo_object
| Name |
|---|
| aide |
Build and Test AIDE Database
| Rule ID | xccdf_org.ssgproject.content_rule_aide_build_database |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-aide_build_database:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83438-2 References: BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000445-GPOS-00199, 1.3.1 |
| Description | Run the following command to generate a new database:
$ sudo /usr/sbin/aide --initBy default, the database will be written to the file /var/lib/aide/aide.db.new.gz.
Storing the database, the configuration file /etc/aide.conf, and the binary
/usr/sbin/aide
(or hashes of these files), in a secure location (such as on read-only media) provides additional assurance about their integrity.
The newly-generated database can be installed as follows:
$ sudo cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gzTo initiate a manual check, run the following command: $ sudo /usr/sbin/aide --checkIf this check produces any unexpected output, investigate. |
| Rationale | For AIDE to be effective, an initial database of "known-good" information about files
must be captured and it should be able to be verified against the installed files. |
package aide is installed oval:ssg-test_package_aide_installed:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_aide_installed:obj:1 of type rpminfo_object
| Name |
|---|
| aide |
Testing existence of new aide database file oval:ssg-test_aide_build_new_database_absolute_path:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_aide_build_new_database_absolute_path:obj:1 of type file_object
| Filepath |
|---|
| Referenced variable has no values (oval:ssg-variable_aide_build_new_database_absolute_path:var:1). |
Testing existence of operational aide database file oval:ssg-test_aide_operational_database_absolute_path:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_aide_operational_database_absolute_path:obj:1 of type file_object
| Filepath |
|---|
| Referenced variable has no values (oval:ssg-variable_aide_operational_database_absolute_path:var:1) |
Configure AIDE to Verify the Audit Tools
| Rule ID | xccdf_org.ssgproject.content_rule_aide_check_audit_tools |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-aide_check_audit_tools:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-87757-1 References: CCI-001496, AU-9(3), AU-9(3).1, SRG-OS-000278-GPOS-00108 |
| Description | The operating system file integrity tool must be configured to protect the integrity of the audit tools. |
| Rationale | Protecting the integrity of the tools used for auditing purposes is a
critical step toward ensuring the integrity of audit information. Audit
information includes all information (e.g., audit records, audit settings,
and audit reports) needed to successfully audit information system
activity.
Audit tools include but are not limited to vendor-provided and open-source
audit tools needed to successfully view and manipulate audit information
system activity and records. Audit tools include custom queries and report
generators.
It is not uncommon for attackers to replace the audit tools or inject code
into the existing tools to provide the capability to hide or erase system
activity from the audit logs.
To address this risk, audit tools must be cryptographically signed to
provide the capability to identify when the audit tools have been modified,
manipulated, or replaced. An example is a checksum hash of the file or
files. |
package aide is installed oval:ssg-test_package_aide_installed:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_aide_installed:obj:1 of type rpminfo_object
| Name |
|---|
| aide |
auditctl is checked in /etc/aide.conf oval:ssg-test_aide_verify_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_aide_verify_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/aide.conf | ^\/usr\/sbin\/auditctl\s+([^\n]+)$ | 1 |
auditd is checked in /etc/aide.conf oval:ssg-test_aide_verify_auditd:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_aide_verify_auditd:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/aide.conf | ^/usr/sbin/auditd\s+([^\n]+)$ | 1 |
ausearch is checked in /etc/aide.conf oval:ssg-test_aide_verify_ausearch:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_aide_verify_ausearch:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/aide.conf | ^/usr/sbin/ausearch\s+([^\n]+)$ | 1 |
aureport is checked in /etc/aide.conf oval:ssg-test_aide_verify_aureport:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_aide_verify_aureport:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/aide.conf | ^/usr/sbin/aureport\s+([^\n]+)$ | 1 |
autrace is checked in /etc/aide.conf oval:ssg-test_aide_verify_autrace:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_aide_verify_autrace:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/aide.conf | ^/usr/sbin/autrace\s+([^\n]+)$ | 1 |
rsyslogd is checked in /etc/aide.conf oval:ssg-test_aide_verify_rsyslogd:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_aide_verify_rsyslogd:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/aide.conf | ^/usr/sbin/rsyslogd\s+([^\n]+)$ | 1 |
augenrules is checked in /etc/aide.conf oval:ssg-test_aide_verify_augenrules:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_aide_verify_augenrules:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/aide.conf | ^/usr/sbin/augenrules\s+([^\n]+)$ | 1 |
Configure Periodic Execution of AIDE
| Rule ID | xccdf_org.ssgproject.content_rule_aide_periodic_cron_checking |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-aide_periodic_cron_checking:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83437-4 References: BP28(R51), 1, 11, 12, 13, 14, 15, 16, 2, 3, 5, 7, 8, 9, 5.10.1.3, APO01.06, BAI01.06, BAI02.01, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS04.07, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.02, DSS06.06, CCI-001744, CCI-002699, CCI-002702, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 4.1, SR 6.2, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.4.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.7, A.15.2.1, A.8.2.3, SI-7, SI-7(1), CM-6(a), DE.CM-1, DE.CM-7, PR.DS-1, PR.DS-6, PR.DS-8, PR.IP-1, PR.IP-3, Req-11.5, SRG-OS-000363-GPOS-00150, SRG-OS-000446-GPOS-00200, SRG-OS-000447-GPOS-00201, 1.3.2 |
| Description | At a minimum, AIDE should be configured to run a weekly scan.
To implement a daily execution of AIDE at 4:05am using cron, add the following line to /etc/crontab:
05 4 * * * root /usr/sbin/aide --checkTo implement a weekly execution of AIDE at 4:05am using cron, add the following line to /etc/crontab:
05 4 * * 0 root /usr/sbin/aide --checkAIDE can be executed periodically through other means; this is merely one example. The usage of cron's special time codes, such as @daily and
@weekly is acceptable. |
| Rationale | By default, AIDE does not install itself for periodic execution. Periodically
running AIDE is necessary to reveal unexpected changes in installed files.
Unauthorized changes to the baseline configuration could make the system vulnerable to various attacks or allow unauthorized access to the operating system. Changes to operating system configurations can have unintended side effects, some of which may be relevant to security. Detecting such changes and providing an automated response can help avoid unintended, negative consequences that could ultimately affect the security state of the operating system. The operating system's Information Management Officer (IMO)/Information System Security Officer (ISSO) and System Administrators (SAs) must be notified via email and/or monitoring system trap when there is an unauthorized modification of a configuration item. |
package aide is installed oval:ssg-test_package_aide_installed:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_aide_installed:obj:1 of type rpminfo_object
| Name |
|---|
| aide |
run aide with cron oval:ssg-test_aide_periodic_cron_checking:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_test_aide_periodic_cron_checking:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/crontab | ^(([0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*(\*|([0-7]|mon|tue|wed|thu|fri|sat|sun)|[0-7]-[0-7]))|@(hourly|daily|weekly))[\s]*root[\s]*\/usr\/sbin\/aide[\s]*\-\-check.*$ | 1 |
run aide with cron oval:ssg-test_aide_crond_checking:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_test_aide_crond_checking:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/cron.d | ^.*$ | ^(([0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*(\*|([0-7]|mon|tue|wed|thu|fri|sat|sun)|[0-7]-[0-7]))|@(hourly|daily|weekly))[\s]*root[\s]*\/usr\/sbin\/aide[\s]*\-\-check.*$ | 1 |
run aide with cron oval:ssg-test_aide_var_cron_checking:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_aide_var_cron_checking:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /var/spool/cron/root | ^(([0-9]*[\s]*[0-9]*[\s]*\*[\s]*\*[\s]*(\*|([0-7]|mon|tue|wed|thu|fri|sat|sun)|[0-7]-[0-7]))|@(hourly|daily|weekly))[\s]*(root)?[\s]*\/usr\/sbin\/aide[\s]*\-\-check.*$ | 1 |
run aide with cron.(daily|weekly) oval:ssg-test_aide_crontabs_checking:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_aide_crontabs_checking:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| ^/etc/cron.(daily|weekly)$ | ^.*$ | ^\s*\/usr\/sbin\/aide[\s]*\-\-check.*$ | 1 |
Audit Tools Must Be Group-owned by Root
| Rule ID | xccdf_org.ssgproject.content_rule_file_audit_tools_group_ownership |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_audit_tools_group_ownership:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-86240-9 References: CCI-001493, CCI-001494, CCI-001495, AU-9, SRG-OS-000256-GPOS-00097, SRG-OS-000257-GPOS-00098, SRG-OS-000258-GPOS-00099 |
| Description | Red Hat Enterprise Linux 9 systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools, and the corresponding rights the user enjoys, to make access decisions regarding the access to audit tools.
Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.
Audit tools must have the correct group owner. |
| Rationale | Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data.
Therefore, protecting audit tools is necessary to prevent unauthorized operations on audit information. |
Testing group ownership of /sbin/auditctl oval:ssg-test_file_groupownerfile_audit_tools_group_ownership_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupownerfile_audit_tools_group_ownership_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /sbin/auditctl | oval:ssg-symlink_file_groupownerfile_audit_tools_group_ownership_uid_0:ste:1 | oval:ssg-state_file_groupownerfile_audit_tools_group_ownership_gid_0_0:ste:1 |
Testing group ownership of /sbin/aureport oval:ssg-test_file_groupownerfile_audit_tools_group_ownership_1:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupownerfile_audit_tools_group_ownership_1:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /sbin/aureport | oval:ssg-symlink_file_groupownerfile_audit_tools_group_ownership_uid_0:ste:1 | oval:ssg-state_file_groupownerfile_audit_tools_group_ownership_gid_0_1:ste:1 |
Testing group ownership of /sbin/ausearch oval:ssg-test_file_groupownerfile_audit_tools_group_ownership_2:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupownerfile_audit_tools_group_ownership_2:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /sbin/ausearch | oval:ssg-symlink_file_groupownerfile_audit_tools_group_ownership_uid_0:ste:1 | oval:ssg-state_file_groupownerfile_audit_tools_group_ownership_gid_0_2:ste:1 |
Testing group ownership of /sbin/autrace oval:ssg-test_file_groupownerfile_audit_tools_group_ownership_3:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupownerfile_audit_tools_group_ownership_3:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /sbin/autrace | oval:ssg-symlink_file_groupownerfile_audit_tools_group_ownership_uid_0:ste:1 | oval:ssg-state_file_groupownerfile_audit_tools_group_ownership_gid_0_3:ste:1 |
Testing group ownership of /sbin/auditd oval:ssg-test_file_groupownerfile_audit_tools_group_ownership_4:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupownerfile_audit_tools_group_ownership_4:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /sbin/auditd | oval:ssg-symlink_file_groupownerfile_audit_tools_group_ownership_uid_0:ste:1 | oval:ssg-state_file_groupownerfile_audit_tools_group_ownership_gid_0_4:ste:1 |
Testing group ownership of /sbin/rsyslogd oval:ssg-test_file_groupownerfile_audit_tools_group_ownership_5:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupownerfile_audit_tools_group_ownership_5:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /sbin/rsyslogd | oval:ssg-symlink_file_groupownerfile_audit_tools_group_ownership_uid_0:ste:1 | oval:ssg-state_file_groupownerfile_audit_tools_group_ownership_gid_0_5:ste:1 |
Testing group ownership of /sbin/augenrules oval:ssg-test_file_groupownerfile_audit_tools_group_ownership_6:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupownerfile_audit_tools_group_ownership_6:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /sbin/augenrules | oval:ssg-symlink_file_groupownerfile_audit_tools_group_ownership_uid_0:ste:1 | oval:ssg-state_file_groupownerfile_audit_tools_group_ownership_gid_0_6:ste:1 |
Audit Tools Must Be Owned by Root
| Rule ID | xccdf_org.ssgproject.content_rule_file_audit_tools_ownership |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_audit_tools_ownership:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-86263-1 References: CCI-001493, CCI-001494, CCI-001495, AU-9, SRG-OS-000256-GPOS-00097, SRG-OS-000257-GPOS-00098, SRG-OS-000258-GPOS-00099 |
| Description | Red Hat Enterprise Linux 9 systems providing tools to interface with audit information will leverage user permissions and roles identifying the user accessing the tools, and the corresponding rights the user enjoys, to make access decisions regarding the access to audit tools.
Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.
Audit tools must have the correct owner. |
| Rationale | Protecting audit information also includes identifying and protecting the tools used to view and manipulate log data.
Therefore, protecting audit tools is necessary to prevent unauthorized operations on audit information. |
Testing user ownership of /sbin/auditctl oval:ssg-test_file_ownerfile_audit_tools_ownership_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_ownerfile_audit_tools_ownership_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /sbin/auditctl | oval:ssg-symlink_file_ownerfile_audit_tools_ownership_uid_0:ste:1 | oval:ssg-state_file_ownerfile_audit_tools_ownership_uid_0_0:ste:1 |
Testing user ownership of /sbin/aureport oval:ssg-test_file_ownerfile_audit_tools_ownership_1:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_ownerfile_audit_tools_ownership_1:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /sbin/aureport | oval:ssg-symlink_file_ownerfile_audit_tools_ownership_uid_0:ste:1 | oval:ssg-state_file_ownerfile_audit_tools_ownership_uid_0_1:ste:1 |
Testing user ownership of /sbin/ausearch oval:ssg-test_file_ownerfile_audit_tools_ownership_2:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_ownerfile_audit_tools_ownership_2:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /sbin/ausearch | oval:ssg-symlink_file_ownerfile_audit_tools_ownership_uid_0:ste:1 | oval:ssg-state_file_ownerfile_audit_tools_ownership_uid_0_2:ste:1 |
Testing user ownership of /sbin/autrace oval:ssg-test_file_ownerfile_audit_tools_ownership_3:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_ownerfile_audit_tools_ownership_3:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /sbin/autrace | oval:ssg-symlink_file_ownerfile_audit_tools_ownership_uid_0:ste:1 | oval:ssg-state_file_ownerfile_audit_tools_ownership_uid_0_3:ste:1 |
Testing user ownership of /sbin/auditd oval:ssg-test_file_ownerfile_audit_tools_ownership_4:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_ownerfile_audit_tools_ownership_4:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /sbin/auditd | oval:ssg-symlink_file_ownerfile_audit_tools_ownership_uid_0:ste:1 | oval:ssg-state_file_ownerfile_audit_tools_ownership_uid_0_4:ste:1 |
Testing user ownership of /sbin/rsyslogd oval:ssg-test_file_ownerfile_audit_tools_ownership_5:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_ownerfile_audit_tools_ownership_5:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /sbin/rsyslogd | oval:ssg-symlink_file_ownerfile_audit_tools_ownership_uid_0:ste:1 | oval:ssg-state_file_ownerfile_audit_tools_ownership_uid_0_5:ste:1 |
Testing user ownership of /sbin/augenrules oval:ssg-test_file_ownerfile_audit_tools_ownership_6:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_ownerfile_audit_tools_ownership_6:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /sbin/augenrules | oval:ssg-symlink_file_ownerfile_audit_tools_ownership_uid_0:ste:1 | oval:ssg-state_file_ownerfile_audit_tools_ownership_uid_0_6:ste:1 |
Configure System Cryptography Policy
| Rule ID | xccdf_org.ssgproject.content_rule_configure_crypto_policy |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-configure_crypto_policy:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | high |
| Identifiers and References | Identifiers: CCE-83450-7 References: 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), 1446, CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, SC-12(2), SC-12(3), FCS_COP.1(1), FCS_COP.1(2), FCS_COP.1(3), FCS_COP.1(4), FCS_CKM.1, FCS_CKM.2, FCS_TLSC_EXT.1, SRG-OS-000396-GPOS-00176, SRG-OS-000393-GPOS-00173, SRG-OS-000394-GPOS-00174, 1.10 |
| Description | To configure the system cryptography policy to use ciphers only from the DEFAULT
policy, run the following command:
$ sudo update-crypto-policies --set DEFAULTThe rule checks if settings for selected crypto policy are configured as expected. Configuration files in the /etc/crypto-policies/back-ends are either symlinks to correct files provided by Crypto-policies package or they are regular files in case crypto policy customizations are applied.
Crypto policies may be customized by crypto policy modules, in which case it is delimited from the base policy using a colon. |
| Rationale | Centralized cryptographic policies simplify applying secure ciphers across an operating system and
the applications that run on that operating system. Use of weak or untested encryption algorithms
undermines the purposes of utilizing encryption to protect data. |
| Warnings | warning
The system needs to be rebooted for these changes to take effect. warning
System Crypto Modules must be provided by a vendor that undergoes
FIPS-140 certifications.
FIPS-140 is applicable to all Federal agencies that use
cryptographic-based security systems to protect sensitive information
in computer and telecommunication systems (including voice systems) as
defined in Section 5131 of the Information Technology Management Reform
Act of 1996, Public Law 104-106. This standard shall be used in
designing and implementing cryptographic modules that Federal
departments and agencies operate or are operated for them under
contract. See https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.140-2.pdf
To meet this, the system has to have cryptographic software provided by
a vendor that has undergone this certification. This means providing
documentation, test results, design information, and independent third
party review by an accredited lab. While open source software is
capable of meeting this, it does not meet FIPS-140 unless the vendor
submits to this process. |
check for crypto policy correctly configured in /etc/crypto-policies/config oval:ssg-test_configure_crypto_policy:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /etc/crypto-policies/config | DEFAULT |
check for crypto policy correctly configured in /etc/crypto-policies/state/current oval:ssg-test_configure_crypto_policy_current:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /etc/crypto-policies/state/current | DEFAULT |
Check if update-crypto-policies has been run oval:ssg-test_crypto_policies_updated:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-variable_crypto_policies_config_file_timestamp:var:1 | 1688733370 |
Check if /etc/crypto-policies/back-ends/nss.config exists oval:ssg-test_crypto_policy_nss_config:tst:1 true
Following items have been found on the system:
| Path | Type | UID | GID | Size (B) | Permissions |
|---|---|---|---|---|---|
| /etc/crypto-policies/back-ends/nss.config | regular | 0 | 0 | 447 | rw-r--r-- |
Configure SSH to use System Crypto Policy
| Rule ID | xccdf_org.ssgproject.content_rule_configure_ssh_crypto_policy |
| Result | error |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-configure_ssh_crypto_policy:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83445-7 References: CCI-001453, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.312(e)(1), 164.312(e)(2)(ii), CIP-003-8 R4.2, CIP-007-3 R5.1, CIP-007-3 R7.1, AC-17(a), AC-17(2), CM-6(a), MA-4(6), SC-13, FCS_SSH_EXT.1, FCS_SSHS_EXT.1, FCS_SSHC_EXT.1, Req-2.2, SRG-OS-000250-GPOS-00093, 5.2.14 |
| Description | Crypto Policies provide a centralized control over crypto algorithms usage of many packages.
SSH is supported by crypto policy, but the SSH configuration may be
set up to ignore it.
To check that Crypto Policies settings are configured correctly, ensure that
the CRYPTO_POLICY variable is either commented or not set at all
in the /etc/sysconfig/sshd. |
| Rationale | Overriding the system crypto policy makes the behavior of the SSH service violate expectations,
and makes system configuration more fragmented. |
Check that the SSH configuration mandates usage of system-wide crypto policies. oval:ssg-test_configure_ssh_crypto_policy:tst:1 error
No items have been found conforming to the following objects:
Object oval:ssg-object_configure_ssh_crypto_policy:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysconfig/sshd | ^\s*(?i)CRYPTO_POLICY\s*=.*$ | 1 |
Set GNOME3 Screensaver Inactivity Timeout
| Rule ID | xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_idle_delay |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-dconf_gnome_screensaver_idle_delay:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-86510-5 References: 1, 12, 15, 16, 5.5.5, DSS05.04, DSS05.10, DSS06.10, 3.1.10, CCI-000057, CCI-000060, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, AC-11(a), CM-6(a), PR.AC-7, FMT_MOF_EXT.1, Req-8.1.8, SRG-OS-000029-GPOS-00010, SRG-OS-000031-GPOS-00012, 1.8.4 |
| Description | The idle time-out value for inactivity in the GNOME3 desktop is configured via the idle-delay
setting must be set under an appropriate configuration file(s) in the /etc/dconf/db/local.d directory
and locked in /etc/dconf/db/local.d/locks directory to prevent user modification.
For example, to configure the system for a 15 minute delay, add the following to /etc/dconf/db/local.d/00-security-settings:
[org/gnome/desktop/session] idle-delay=uint32 900 |
| Rationale | A session time-out lock is a temporary action taken when a user stops work and moves away from
the immediate physical vicinity of the information system but does not logout because of the
temporary nature of the absence. Rather than relying on the user to manually lock their operating
system session prior to vacating the vicinity, GNOME3 can be configured to identify when
a user's session has idled and take action to initiate a session lock. |
package dconf is installed oval:ssg-test_package_dconf_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| dconf | x86_64 | (none) | 6.el9 | 0.40.0 | 0:0.40.0-6.el9 | 199e2f91fd431d51 | dconf-0:0.40.0-6.el9.x86_64 |
package dconf is installed oval:ssg-test_package_dconf_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| dconf | x86_64 | (none) | 6.el9 | 0.40.0 | 0:0.40.0-6.el9 | 199e2f91fd431d51 | dconf-0:0.40.0-6.el9.x86_64 |
dconf user profile exists oval:ssg-test_dconf_user_profile:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /etc/dconf/profile/user | user-db:user system-db:local |
screensaver idle delay is configured oval:ssg-test_screensaver_idle_delay:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_screensaver_idle_delay:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/dconf/db/local.d/ | ^.*$ | ^\[org/gnome/desktop/session\]([^\n]*\n+)+?idle-delay=uint32[\s][0-9]*$ | 1 |
screensaver idle delay setting is correct oval:ssg-test_screensaver_idle_delay_setting:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_screensaver_idle_delay_setting:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/dconf/db/local.d/ | ^.*$ | ^idle-delay[\s=]*uint32[\s]([^=\s]*) | 1 |
Set GNOME3 Screensaver Lock Delay After Activation Period
| Rule ID | xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_lock_delay |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-dconf_gnome_screensaver_lock_delay:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-86954-5 References: 1, 12, 15, 16, DSS05.04, DSS05.10, DSS06.10, 3.1.10, CCI-000056, CCI-000057, CCI-000060, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, AC-11(a), CM-6(a), PR.AC-7, FMT_MOF_EXT.1, Req-8.1.8, SRG-OS-000029-GPOS-00010, SRG-OS-000031-GPOS-00012, 1.8.4 |
| Description | To activate the locking delay of the screensaver in the GNOME3 desktop when
the screensaver is activated, add or set lock-delay to uint32 5 in
/etc/dconf/db/local.d/00-security-settings. For example:
[org/gnome/desktop/screensaver] lock-delay=uint32 5After the settings have been set, run dconf update. |
| Rationale | A session lock is a temporary action taken when a user stops work and moves away from the immediate physical vicinity
of the information system but does not want to logout because of the temporary nature of the absense. |
package dconf is installed oval:ssg-test_package_dconf_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| dconf | x86_64 | (none) | 6.el9 | 0.40.0 | 0:0.40.0-6.el9 | 199e2f91fd431d51 | dconf-0:0.40.0-6.el9.x86_64 |
package dconf is installed oval:ssg-test_package_dconf_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| dconf | x86_64 | (none) | 6.el9 | 0.40.0 | 0:0.40.0-6.el9 | 199e2f91fd431d51 | dconf-0:0.40.0-6.el9.x86_64 |
dconf user profile exists oval:ssg-test_dconf_user_profile:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /etc/dconf/profile/user | user-db:user system-db:local |
screensaver lock is set correctly oval:ssg-test_screensaver_lock_delay:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_screensaver_lock_delay:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/dconf/db/local.d/ | ^.*$ | ^\[org/gnome/desktop/screensaver\]([^\n]*\n+)+?lock-delay=uint32[\s][0-9]*$ | 1 |
screensaver lock delay setting is correct oval:ssg-test_screensaver_lock_delay_setting:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_screensaver_lock_delay_setting:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/dconf/db/local.d/ | ^.*$ | ^lock-delay[\s=]*uint32[\s]([^=\s]*) | 1 |
Ensure Users Cannot Change GNOME3 Screensaver Settings
| Rule ID | xccdf_org.ssgproject.content_rule_dconf_gnome_screensaver_user_locks |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-dconf_gnome_screensaver_user_locks:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-87491-7 References: 1, 12, 15, 16, DSS05.04, DSS05.10, DSS06.10, 3.1.10, CCI-000057, CCI-000060, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, CM-6(a), PR.AC-7, FMT_MOF_EXT.1, SRG-OS-000029-GPOS-00010, SRG-OS-000031-GPOS-00012, 1.8.5 |
| Description | If not already configured, ensure that users cannot change GNOME3 screensaver lock settings
by adding /org/gnome/desktop/screensaver/lock-delay
to /etc/dconf/db/local.d/locks/00-security-settings-lock to prevent user modification.
For example:
/org/gnome/desktop/screensaver/lock-delayAfter the settings have been set, run dconf update. |
| Rationale | A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate
physical vicinity of the information system but does not logout because of the temporary nature of the absence.
Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,
GNOME desktops can be configured to identify when a user's session has idled and take action to initiate the
session lock. As such, users should not be allowed to change session settings. |
package dconf is installed oval:ssg-test_package_dconf_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| dconf | x86_64 | (none) | 6.el9 | 0.40.0 | 0:0.40.0-6.el9 | 199e2f91fd431d51 | dconf-0:0.40.0-6.el9.x86_64 |
package dconf is installed oval:ssg-test_package_dconf_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| dconf | x86_64 | (none) | 6.el9 | 0.40.0 | 0:0.40.0-6.el9 | 199e2f91fd431d51 | dconf-0:0.40.0-6.el9.x86_64 |
dconf user profile exists oval:ssg-test_dconf_user_profile:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /etc/dconf/profile/user | user-db:user system-db:local |
screensaver lock delay cannot be changed by user oval:ssg-test_user_change_lock_delay_lock:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_user_change_lock_delay_lock:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/dconf/db/local.d/locks/ | ^.*$ | ^/org/gnome/desktop/screensaver/lock-delay$ | 1 |
Ensure Users Cannot Change GNOME3 Session Idle Settings
| Rule ID | xccdf_org.ssgproject.content_rule_dconf_gnome_session_idle_user_locks |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-dconf_gnome_session_idle_user_locks:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-85971-0 References: 1, 12, 15, 16, DSS05.04, DSS05.10, DSS06.10, 3.1.10, CCI-000057, CCI-000060, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, CM-6(a), PR.AC-7, FMT_MOF_EXT.1, Req-8.1.8, SRG-OS-000029-GPOS-00010, SRG-OS-000031-GPOS-00012, 1.8.5 |
| Description | If not already configured, ensure that users cannot change GNOME3 session idle settings
by adding /org/gnome/desktop/session/idle-delay
to /etc/dconf/db/local.d/locks/00-security-settings-lock to prevent user modification.
For example:
/org/gnome/desktop/session/idle-delayAfter the settings have been set, run dconf update. |
| Rationale | A session time-out lock is a temporary action taken when a user stops work and moves away from the immediate
physical vicinity of the information system but does not logout because of the temporary nature of the absence.
Rather than relying on the user to manually lock their operating system session prior to vacating the vicinity,
GNOME desktops can be configured to identify when a user's session has idled and take action to initiate the
session lock. As such, users should not be allowed to change session settings. |
package dconf is installed oval:ssg-test_package_dconf_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| dconf | x86_64 | (none) | 6.el9 | 0.40.0 | 0:0.40.0-6.el9 | 199e2f91fd431d51 | dconf-0:0.40.0-6.el9.x86_64 |
package dconf is installed oval:ssg-test_package_dconf_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| dconf | x86_64 | (none) | 6.el9 | 0.40.0 | 0:0.40.0-6.el9 | 199e2f91fd431d51 | dconf-0:0.40.0-6.el9.x86_64 |
dconf user profile exists oval:ssg-test_dconf_user_profile:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /etc/dconf/profile/user | user-db:user system-db:local |
user cannot change screensaver idle delay oval:ssg-test_user_change_idle_delay_lock:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_user_change_idle_delay_lock:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/dconf/db/local.d/locks/ | ^.*$ | ^/org/gnome/desktop/session/idle-delay$ | 1 |
Install sudo Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_sudo_installed |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_sudo_installed:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83523-1 References: BP28(R19), 1382, 1384, 1386, CM-6(a), FMT_MOF_EXT.1, Req-10.2.1.5, SRG-OS-000324-GPOS-00125, 5.3.1 |
| Description | The sudo package can be installed with the following command:
$ sudo dnf install sudo |
| Rationale | sudo is a program designed to allow a system administrator to give
limited root privileges to users and log root activity. The basic philosophy
is to give as few privileges as possible but still allow system users to
get their work done. |
package sudo is installed oval:ssg-test_package_sudo_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| sudo | x86_64 | (none) | 9.el9 | 1.9.5p2 | 0:1.9.5p2-9.el9 | 199e2f91fd431d51 | sudo-0:1.9.5p2-9.el9.x86_64 |
Ensure Only Users Logged In To Real tty Can Execute Sudo - sudo use_pty
| Rule ID | xccdf_org.ssgproject.content_rule_sudo_add_use_pty |
| Result | error |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sudo_add_use_pty:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83538-9 References: BP28(R58), Req-10.2.1.5, 5.3.2 |
| Description | The sudo use_pty tag, when specified, will only execute sudo
commands from users logged in to a real tty.
This should be enabled by making sure that the use_pty tag exists in
/etc/sudoers configuration file or any sudo configuration snippets
in /etc/sudoers.d/. |
| Rationale | Requiring that sudo commands be run in a pseudo-terminal can prevent an attacker from retaining
access to the user's terminal after the main program has finished executing. |
use_pty exists in /etc/sudoers or /etc/sudoers.d/ oval:ssg-test_use_pty_sudoers:tst:1 error
No items have been found conforming to the following objects:
Object oval:ssg-object_use_pty_sudoers:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/sudoers(|\.d/.*)$ | ^[\s]*Defaults[\s]*\buse_pty.*$ | 1 |
Ensure Sudo Logfile Exists - sudo logfile
| Rule ID | xccdf_org.ssgproject.content_rule_sudo_custom_logfile |
| Result | error |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sudo_custom_logfile:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | low |
| Identifiers and References | Identifiers: CCE-83527-2 References: Req-10.2.1.5, 5.3.3 |
| Description | A custom log sudo file can be configured with the 'logfile' tag. This rule configures
a sudo custom logfile at the default location suggested by CIS, which uses
/var/log/sudo.log. |
| Rationale | A sudo log file simplifies auditing of sudo commands. |
logfile exists in /etc/sudoers or /etc/sudoers.d/ oval:ssg-test_logfile_sudoers:tst:1 error
No items have been found conforming to the following objects:
Object oval:ssg-object_logfile_sudoers:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/sudoers(|\.d/.*)$ | ^[\s]*Defaults[\s]*\blogfile=("(?:\\"|\\\\|[^"\\\n])*"\B|[^"](?:(?:\\,|\\"|\\ |\\\\|[^", \\\n])*)\b).*$ | 1 |
The operating system must require Re-Authentication when using the sudo command. Ensure sudo timestamp_timeout is appropriate - sudo timestamp_timeout
| Rule ID | xccdf_org.ssgproject.content_rule_sudo_require_reauthentication |
| Result | error |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sudo_require_reauthentication:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-90029-0 References: CCI-002038, IA-11, SRG-OS-000373-GPOS-00156, SRG-OS-000373-GPOS-00157, SRG-OS-000373-GPOS-00158, 5.3.5, 5.3.6 |
| Description | The sudo timestamp_timeout tag sets the amount of time sudo password prompt waits.
The default timestamp_timeout value is 5 minutes.
The timestamp_timeout should be configured by making sure that the
timestamp_timeout tag exists in
/etc/sudoers configuration file or any sudo configuration snippets
in /etc/sudoers.d/.
If the value is set to an integer less than 0, the user's time stamp will not expire
and the user will not have to re-authenticate for privileged actions until the user's session is terminated. |
| Rationale | Without re-authentication, users may access resources or perform tasks for which they
do not have authorization.
When operating systems provide the capability to escalate a functional capability, it is critical that the user re-authenticate. |
check correct configuration in /etc/sudoers oval:ssg-test_sudo_timestamp_timeout:tst:1 error
No items have been found conforming to the following objects:
Object oval:ssg-obj_sudo_timestamp_timeout:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/sudoers(\.d/.*)?$ | ^[\s]*Defaults[\s]+timestamp_timeout[\s]*=[\s]*([-]?[\d]+)$ | 1 |
Install openscap-scanner Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_openscap-scanner_installed |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_openscap-scanner_installed:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83502-5 References: AGD_PRE.1, AGD_OPE.1, SRG-OS-000480-GPOS-00227, SRG-OS-000191-GPOS-00080 |
| Description | The openscap-scanner package can be installed with the following command:
$ sudo dnf install openscap-scanner |
| Rationale | openscap-scanner contains the oscap command line tool. This tool is a
configuration and vulnerability scanner, capable of performing compliance checking using
SCAP content. |
package openscap-scanner is installed oval:ssg-test_package_openscap-scanner_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| openscap-scanner | x86_64 | 1 | 1.el9 | 1.3.7 | 1:1.3.7-1.el9 | 199e2f91fd431d51 | openscap-scanner-1:1.3.7-1.el9.x86_64 |
Install scap-security-guide Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_scap-security-guide_installed |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_scap-security-guide_installed:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83505-8 References: AGD_PRE.1, AGD_OPE.1, SRG-OS-000480-GPOS-00227 |
| Description | The scap-security-guide package can be installed with the following command:
$ sudo dnf install scap-security-guide |
| Rationale | The scap-security-guide package provides a guide for configuration of the system
from the final system's security point of view. The guidance is specified in the Security
Content Automation Protocol (SCAP) format and constitutes a catalog of practical hardening
advice, linked to government requirements where applicable. The SCAP Security Guide project
bridges the gap between generalized policy requirements and specific implementation guidelines.
A system administrator can use the oscap CLI tool from the openscap-scanner
package, or the SCAP Workbench GUI tool from the scap-workbench package, to verify
that the system conforms to provided guidelines. Refer to the scap-security-guide(8) manual
page for futher information. |
package scap-security-guide is installed oval:ssg-test_package_scap-security-guide_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| scap-security-guide | noarch | (none) | 1.el9_1 | 0.1.66 | 0:0.1.66-1.el9_1 | 199e2f91fd431d51 | scap-security-guide-0:0.1.66-1.el9_1.noarch |
Install subscription-manager Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_subscription-manager_installed |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_subscription-manager_installed:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83506-6 References: 0940, 1144, 1467, 1472, 1483, 1493, 1494, 1495, FPT_TUD_EXT.1, FPT_TUD_EXT.2, SRG-OS-000366-GPOS-00153 |
| Description | The subscription-manager package can be installed with the following command:
$ sudo dnf install subscription-manager |
| Rationale | Red Hat Subscription Manager is a local service which tracks installed products
and subscriptions on a local system to help manage subscription assignments.
It communicates with the backend subscription service (the Customer Portal
or an on-premise server such as Subscription Asset Manager) and works with
content management tools such as .
The package provides, among other things, plugins
to interact with repositories and subscriptions
from the Red Hat entitlement platform - the subscription-manager and
product-id plugins. |
package subscription-manager is installed oval:ssg-test_package_subscription-manager_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| subscription-manager | x86_64 | (none) | 1.el9_2 | 1.29.33.1 | 0:1.29.33.1-1.el9_2 | 199e2f91fd431d51 | subscription-manager-0:1.29.33.1-1.el9_2.x86_64 |
Install dnf-automatic Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_dnf-automatic_installed |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_dnf-automatic_installed:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83454-9 References: BP28(R8), SRG-OS-000191-GPOS-00080 |
| Description | The dnf-automatic package can be installed with the following command:
$ sudo dnf install dnf-automatic |
| Rationale | dnf-automatic is an alternative command line interface (CLI)
to dnf upgrade suitable for automatic, regular execution. |
package dnf-automatic is installed oval:ssg-test_package_dnf-automatic_installed:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_dnf-automatic_installed:obj:1 of type rpminfo_object
| Name |
|---|
| dnf-automatic |
Ensure gpgcheck Enabled In Main dnf Configuration
| Rule ID | xccdf_org.ssgproject.content_rule_ensure_gpgcheck_globally_activated |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-ensure_gpgcheck_globally_activated:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | high |
| Identifiers and References | Identifiers: CCE-83457-2 References: BP28(R15), 11, 2, 3, 9, 5.10.4.1, APO01.06, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS06.02, 3.4.8, CCI-001749, 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i), 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, CM-5(3), SI-7, SC-12, SC-12(3), CM-6(a), SA-12, SA-12(10), CM-11(a), CM-11(b), PR.DS-6, PR.DS-8, PR.IP-1, FPT_TUD_EXT.1, FPT_TUD_EXT.2, Req-6.2, SRG-OS-000366-GPOS-00153, SRG-OS-000366-VMM-001430, SRG-OS-000370-VMM-001460, SRG-OS-000404-VMM-001650, 1.2.2 |
| Description | The gpgcheck option controls whether
RPM packages' signatures are always checked prior to installation.
To configure dnf to check package signatures before installing
them, ensure the following line appears in /etc/dnf/dnf.conf in
the [main] section:
gpgcheck=1 |
| Rationale | Changes to any software components can have significant effects on the
overall security of the operating system. This requirement ensures the
software has not been tampered with and that it has been provided by a
trusted vendor.
Accordingly, patches, service packs, device drivers, or operating system components must be signed with a certificate recognized and approved by the organization. Verifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and that it has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. Certificates used to verify the software must be from an approved Certificate Authority (CA). |
check value of gpgcheck in /etc/dnf/dnf.conf oval:ssg-test_ensure_gpgcheck_globally_activated:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /etc/dnf/dnf.conf | gpgcheck=1 |
Ensure Red Hat GPG Key Installed
| Rule ID | xccdf_org.ssgproject.content_rule_ensure_redhat_gpgkey_installed |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-ensure_redhat_gpgkey_installed:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | high |
| Identifiers and References | Identifiers: CCE-84180-9 References: BP28(R15), 11, 2, 3, 9, 5.10.4.1, APO01.06, BAI03.05, BAI06.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS06.02, 3.4.8, CCI-001749, 164.308(a)(1)(ii)(D), 164.312(b), 164.312(c)(1), 164.312(c)(2), 164.312(e)(2)(i), 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.4, SR 3.1, SR 3.3, SR 3.4, SR 3.8, SR 7.6, A.11.2.4, A.12.1.2, A.12.2.1, A.12.5.1, A.12.6.2, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, CIP-003-8 R4.2, CIP-003-8 R6, CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1, CM-5(3), SI-7, SC-12, SC-12(3), CM-6(a), PR.DS-6, PR.DS-8, PR.IP-1, FPT_TUD_EXT.1, FPT_TUD_EXT.2, Req-6.2, SRG-OS-000366-GPOS-00153, SRG-OS-000366-VMM-001430, SRG-OS-000370-VMM-001460, SRG-OS-000404-VMM-001650, 1.2.1 |
| Description | To ensure the system can cryptographically verify base software packages
come from Red Hat (and to connect to the Red Hat Network to receive them),
the Red Hat GPG key must properly be installed. To install the Red Hat GPG
key, run:
$ sudo subscription-manager registerIf the system is not connected to the Internet or an RHN Satellite, then install the Red Hat GPG key from trusted media such as the Red Hat installation CD-ROM or DVD. Assuming the disc is mounted in /media/cdrom, use the following command as the root user to import
it into the keyring:
$ sudo rpm --import /media/cdrom/RPM-GPG-KEYAlternatively, the key may be pre-loaded during the RHEL installation. In such cases, the key can be installed by running the following command: sudo rpm --import /etc/pki/rpm-gpg/RPM-GPG-KEY-redhat-release |
| Rationale | Changes to software components can have significant effects on the overall
security of the operating system. This requirement ensures the software has
not been tampered with and that it has been provided by a trusted vendor.
The Red Hat GPG key is necessary to cryptographically verify packages are
from Red Hat. |
installed OS part of unix family oval:ssg-test_rhel9_unix_family:tst:1 true
Following items have been found on the system:
| Family |
|---|
| unix |
installed OS part of unix family oval:ssg-test_rhel9_unix_family:tst:1 true
Following items have been found on the system:
| Family |
|---|
| unix |
redhat-release is version 9 oval:ssg-test_rhel9:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| redhat-release | x86_64 | (none) | 0.13.el9 | 9.2 | 0:9.2-0.13.el9 | 199e2f91fd431d51 | redhat-release-0:9.2-0.13.el9.x86_64 |
redhat-release is version 9 oval:ssg-test_rhel9:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| redhat-release | x86_64 | (none) | 0.13.el9 | 9.2 | 0:9.2-0.13.el9 | 199e2f91fd431d51 | redhat-release-0:9.2-0.13.el9.x86_64 |
redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object
| Name |
|---|
| redhat-release-virtualization-host |
redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object
| Name |
|---|
| redhat-release-virtualization-host |
RHEVH base RHEL is version 9 oval:ssg-test_rhevh_rhel9_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhevh_rhel9_version:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/redhat-release | ^Red Hat Enterprise Linux release (\d)\.\d+$ | 1 |
RHEVH base RHEL is version 9 oval:ssg-test_rhevh_rhel9_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhevh_rhel9_version:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/redhat-release | ^Red Hat Enterprise Linux release (\d)\.\d+$ | 1 |
installed OS part of unix family oval:ssg-test_rhel9_unix_family:tst:1 true
Following items have been found on the system:
| Family |
|---|
| unix |
installed OS part of unix family oval:ssg-test_rhel9_unix_family:tst:1 true
Following items have been found on the system:
| Family |
|---|
| unix |
redhat-release is version 9 oval:ssg-test_rhel9:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| redhat-release | x86_64 | (none) | 0.13.el9 | 9.2 | 0:9.2-0.13.el9 | 199e2f91fd431d51 | redhat-release-0:9.2-0.13.el9.x86_64 |
redhat-release is version 9 oval:ssg-test_rhel9:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| redhat-release | x86_64 | (none) | 0.13.el9 | 9.2 | 0:9.2-0.13.el9 | 199e2f91fd431d51 | redhat-release-0:9.2-0.13.el9.x86_64 |
redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object
| Name |
|---|
| redhat-release-virtualization-host |
redhat-release-virtualization-host RPM package is installed oval:ssg-test_rhvh4_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhvh4_version:obj:1 of type rpminfo_object
| Name |
|---|
| redhat-release-virtualization-host |
RHEVH base RHEL is version 9 oval:ssg-test_rhevh_rhel9_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhevh_rhel9_version:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/redhat-release | ^Red Hat Enterprise Linux release (\d)\.\d+$ | 1 |
RHEVH base RHEL is version 9 oval:ssg-test_rhevh_rhel9_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_rhevh_rhel9_version:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/redhat-release | ^Red Hat Enterprise Linux release (\d)\.\d+$ | 1 |
Red Hat release key package is installed oval:ssg-test_package_gpgkey-fd431d51-4ae0493b_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| gpg-pubkey | (none) | (none) | 4ae0493b | fd431d51 | 0:fd431d51-4ae0493b | 0 | gpg-pubkey-0:fd431d51-4ae0493b.(none) |
| gpg-pubkey | (none) | (none) | 6229229e | 5a6340b3 | 0:5a6340b3-6229229e | 0 | gpg-pubkey-0:5a6340b3-6229229e.(none) |
Red Hat auxiliary key package is installed oval:ssg-test_package_gpgkey-5a6340b3-6229229e_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| gpg-pubkey | (none) | (none) | 4ae0493b | fd431d51 | 0:fd431d51-4ae0493b | 0 | gpg-pubkey-0:fd431d51-4ae0493b.(none) |
| gpg-pubkey | (none) | (none) | 6229229e | 5a6340b3 | 0:5a6340b3-6229229e | 0 | gpg-pubkey-0:5a6340b3-6229229e.(none) |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
| Family |
|---|
| unix |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
| Family |
|---|
| unix |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Check os-release ID oval:ssg-test_centos9_name:tst:1 false
Following items have been found on the system:
| Path | Content |
|---|---|
| /etc/os-release | ID="rhel" |
Check os-release ID oval:ssg-test_centos9_name:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_name_centos9:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/os-release | ^ID="(\w+)"$ | 1 |
Check os-release VERSION_ID oval:ssg-test_centos9_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_version_centos9:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/os-release | ^VERSION_ID="(\d)"$ | 1 |
Check os-release VERSION_ID oval:ssg-test_centos9_version:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_version_centos9:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/os-release | ^VERSION_ID="(\d)"$ | 1 |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
| Family |
|---|
| unix |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 true
Following items have been found on the system:
| Family |
|---|
| unix |
Test installed OS is part of the unix family oval:ssg-test_unix_family:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-object_unix_family:obj:1 of type family_object
Check os-release ID oval:ssg-test_centos9_name:tst:1 false
Following items have been found on the system:
| Path | Content |
|---|---|
| /etc/os-release | ID="rhel" |
Check os-release ID oval:ssg-test_centos9_name:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_name_centos9:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/os-release | ^ID="(\w+)"$ | 1 |
Check os-release VERSION_ID oval:ssg-test_centos9_version:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_version_centos9:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/os-release | ^VERSION_ID="(\d)"$ | 1 |
Check os-release VERSION_ID oval:ssg-test_centos9_version:tst:1 not evaluated
No items have been found conforming to the following objects:
Object oval:ssg-obj_version_centos9:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/os-release | ^VERSION_ID="(\d)"$ | 1 |
CentOS9 key package is installed oval:ssg-test_package_gpgkey-8483c65d-5ccc5b19_installed:tst:1 false
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| gpg-pubkey | (none) | (none) | 4ae0493b | fd431d51 | 0:fd431d51-4ae0493b | 0 | gpg-pubkey-0:fd431d51-4ae0493b.(none) |
| gpg-pubkey | (none) | (none) | 6229229e | 5a6340b3 | 0:5a6340b3-6229229e | 0 | gpg-pubkey-0:5a6340b3-6229229e.(none) |
Prefer to use a 64-bit Operating System when supported
| Rule ID | xccdf_org.ssgproject.content_rule_prefer_64bit_os |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-prefer_64bit_os:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-90839-2 References: BP28(R10) |
| Description | Prefer installation of 64-bit operating systems when the CPU supports it. |
| Rationale | Use of a 64-bit operating system offers a few advantages, like a larger address space range for
Address Space Layout Randomization (ASLR) and systematic presence of No eXecute and Execute Disable (NX/XD) protection bits. |
| Warnings | warning
There is no remediation besides installing a 64-bit operating system. |
Check if kernel nvr arch is 64-bit oval:ssg-test_proc_sys_kernel_osrelease_64_bit:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /proc/sys/kernel/osrelease | 5.14.0-284.11.1.el9_2.x86_64 |
Check for CPU flag lm oval:ssg-test_proc_cpuinfo_64_bit:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /proc/cpuinfo | flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 syscall nx rdtscp lm constant_tsc arch_perfmon nopl xtopology tsc_reliable nonstop_tsc cpuid tsc_known_freq pni pclmulqdq ssse3 cx16 sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes hypervisor lahf_lm pti ssbd ibrs ibpb stibp tsc_adjust arat flush_l1d arch_capabilities |
| /proc/cpuinfo | flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 syscall nx rdtscp lm constant_tsc arch_perfmon nopl xtopology tsc_reliable nonstop_tsc cpuid tsc_known_freq pni pclmulqdq ssse3 cx16 sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes hypervisor lahf_lm pti ssbd ibrs ibpb stibp tsc_adjust arat flush_l1d arch_capabilities |
| /proc/cpuinfo | flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 syscall nx rdtscp lm constant_tsc arch_perfmon nopl xtopology tsc_reliable nonstop_tsc cpuid tsc_known_freq pni pclmulqdq ssse3 cx16 sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes hypervisor lahf_lm pti ssbd ibrs ibpb stibp tsc_adjust arat flush_l1d arch_capabilities |
| /proc/cpuinfo | flags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 syscall nx rdtscp lm constant_tsc arch_perfmon nopl xtopology tsc_reliable nonstop_tsc cpuid tsc_known_freq pni pclmulqdq ssse3 cx16 sse4_1 sse4_2 x2apic popcnt tsc_deadline_timer aes hypervisor lahf_lm pti ssbd ibrs ibpb stibp tsc_adjust arat flush_l1d arch_capabilities |
Verify Group Ownership of System Login Banner
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_etc_issue:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-86699-6 References: 1.7.5 |
| Description |
To properly set the group owner of /etc/issue, run the command:
$ sudo chgrp root /etc/issue |
| Rationale | Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance. Proper group ownership will ensure that only root user can modify the banner. |
Testing group ownership of /etc/issue oval:ssg-test_file_groupowner_etc_issue_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_etc_issue_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/issue | oval:ssg-symlink_file_groupowner_etc_issue_uid_0:ste:1 | oval:ssg-state_file_groupowner_etc_issue_gid_0_0:ste:1 |
Verify Group Ownership of System Login Banner for Remote Connections
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_etc_issue_net |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_etc_issue_net:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-86052-8 References: 1.7.6 |
| Description |
To properly set the group owner of /etc/issue.net, run the command:
$ sudo chgrp root /etc/issue.net |
| Rationale | Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance. Proper group ownership will ensure that only root user can modify the banner. |
Testing group ownership of /etc/issue.net oval:ssg-test_file_groupowner_etc_issue_net_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_etc_issue_net_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/issue.net | oval:ssg-symlink_file_groupowner_etc_issue_net_uid_0:ste:1 | oval:ssg-state_file_groupowner_etc_issue_net_gid_0_0:ste:1 |
Verify Group Ownership of Message of the Day Banner
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_etc_motd |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_etc_motd:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-86697-0 References: 1.7.4 |
| Description |
To properly set the group owner of /etc/motd, run the command:
$ sudo chgrp root /etc/motd |
| Rationale | Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance. Proper group ownership will ensure that only root user can modify the banner. |
Testing group ownership of /etc/motd oval:ssg-test_file_groupowner_etc_motd_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_etc_motd_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/motd | oval:ssg-symlink_file_groupowner_etc_motd_uid_0:ste:1 | oval:ssg-state_file_groupowner_etc_motd_gid_0_0:ste:1 |
Verify ownership of System Login Banner
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_etc_issue |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_etc_issue:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-86700-2 References: 1.7.5 |
| Description |
To properly set the owner of /etc/issue, run the command:
$ sudo chown root /etc/issue |
| Rationale | Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance. Proper ownership will ensure that only root user can modify the banner. |
Testing user ownership of /etc/issue oval:ssg-test_file_owner_etc_issue_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_etc_issue_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/issue | oval:ssg-symlink_file_owner_etc_issue_uid_0:ste:1 | oval:ssg-state_file_owner_etc_issue_uid_0_0:ste:1 |
Verify ownership of System Login Banner for Remote Connections
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_etc_issue_net |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_etc_issue_net:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-86057-7 References: 1.7.6 |
| Description |
To properly set the owner of /etc/issue.net, run the command:
$ sudo chown root /etc/issue.net |
| Rationale | Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance. Proper ownership will ensure that only root user can modify the banner. |
Testing user ownership of /etc/issue.net oval:ssg-test_file_owner_etc_issue_net_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_etc_issue_net_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/issue.net | oval:ssg-symlink_file_owner_etc_issue_net_uid_0:ste:1 | oval:ssg-state_file_owner_etc_issue_net_uid_0_0:ste:1 |
Verify ownership of Message of the Day Banner
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_etc_motd |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_etc_motd:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-86698-8 References: 1.7.4 |
| Description |
To properly set the owner of /etc/motd, run the command:
$ sudo chown root /etc/motd |
| Rationale | Display of a standardized and approved use notification before granting
access to the operating system ensures privacy and security notification
verbiage used is consistent with applicable federal laws, Executive Orders,
directives, policies, regulations, standards, and guidance. Proper ownership will ensure that only root user can modify the banner. |
Testing user ownership of /etc/motd oval:ssg-test_file_owner_etc_motd_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_etc_motd_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/motd | oval:ssg-symlink_file_owner_etc_motd_uid_0:ste:1 | oval:ssg-state_file_owner_etc_motd_uid_0_0:ste:1 |
Limit Password Reuse: password-auth
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_password_auth |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_pam_pwhistory_remember_password_auth:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-86354-8 References: BP28(R18), 1, 12, 15, 16, 5, 5.6.2.1.1, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.5.8, CCI-000200, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(f), IA-5(1)(e), PR.AC-1, PR.AC-6, PR.AC-7, Req-8.2.5, SRG-OS-000077-GPOS-00045, SRG-OS-000077-VMM-000440, 5.5.3 |
| Description | Do not allow users to reuse recent passwords. This can be accomplished by using the
remember option for the pam_pwhistory PAM module.
On systems with newer versions of authselect, the pam_pwhistory PAM module
can be enabled via authselect feature:
authselect enable-feature with-pwhistoryOtherwise, it should be enabled using an authselect custom profile. Newer systems also have the /etc/security/pwhistory.conf file for setting
pam_pwhistory module options. This file should be used whenever available.
Otherwise, the pam_pwhistory module options can be set in PAM files.
The value for remember option must be equal or greater than
5 |
| Rationale | Preventing re-use of previous passwords helps ensure that a compromised password is not
re-used by a user. |
| Warnings | warning
If the system relies on authselect tool to manage PAM settings, the remediation
will also use authselect tool. However, if any manual modification was made in
PAM files, the authselect integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.warning
Newer versions of authselect contain an authselect feature to easily and properly
enable pam_pwhistory.so module. If this feature is not yet available in your
system, an authselect custom profile must be used to avoid integrity issues in PAM files.
If a custom profile was created and used in the system before this authselect feature was
available, the new feature can't be used with this custom profile and the
remediation will fail. In this case, the custom profile should be recreated or manually
updated. |
Check pam_pwhistory.so presence in /etc/pam.d/password-auth oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_password_pam_pwhistory_remember_password_auth:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance | |||||
|---|---|---|---|---|---|---|---|
| /etc/pam.d/password-auth | 1 |
Check remember parameter is present and correct in /etc/pam.d/password-auth oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth_pamd:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_password_pam_pwhistory_remember_password_auth_pamd:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance | ||
|---|---|---|---|---|
| /etc/pam.d/password-auth | 1 |
Check the absence of remember parameter in /etc/security/pwhistory.conf oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth_no_pwhistory_conf:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_password_pam_pwhistory_remember_password_auth_param_conf:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^\s*remember\s*=\s*([0-9]+) | ^/etc/security/pwhistory.conf$ | 1 |
Check remember parameter is absent in /etc/pam.d/password-auth oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth_no_pamd:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_password_pam_pwhistory_remember_password_auth_pamd:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^\s*password\b.*\bpam_pwhistory\.so\b.*\bremember=([0-9]*).*$ | /etc/pam.d/password-auth | 1 |
Check remember parameter is present and correct in /etc/security/pwhistory.conf oval:ssg-test_accounts_password_pam_pwhistory_remember_password_auth_pwhistory_conf:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_password_pam_pwhistory_remember_password_auth_param_conf:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance | ||
|---|---|---|---|---|
| ^/etc/security/pwhistory.conf$ | 1 |
Limit Password Reuse: system-auth
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_pwhistory_remember_system_auth |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_pam_pwhistory_remember_system_auth:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-89176-2 References: BP28(R18), 1, 12, 15, 16, 5, 5.6.2.1.1, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.5.8, CCI-000200, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(f), IA-5(1)(e), PR.AC-1, PR.AC-6, PR.AC-7, Req-8.2.5, SRG-OS-000077-GPOS-00045, SRG-OS-000077-VMM-000440, 5.5.3 |
| Description | Do not allow users to reuse recent passwords. This can be accomplished by using the
remember option for the pam_pwhistory PAM module.
On systems with newer versions of authselect, the pam_pwhistory PAM module
can be enabled via authselect feature:
authselect enable-feature with-pwhistoryOtherwise, it should be enabled using an authselect custom profile. Newer systems also have the /etc/security/pwhistory.conf file for setting
pam_pwhistory module options. This file should be used whenever available.
Otherwise, the pam_pwhistory module options can be set in PAM files.
The value for remember option must be equal or greater than
5 |
| Rationale | Preventing re-use of previous passwords helps ensure that a compromised password is not
re-used by a user. |
| Warnings | warning
If the system relies on authselect tool to manage PAM settings, the remediation
will also use authselect tool. However, if any manual modification was made in
PAM files, the authselect integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.warning
Newer versions of authselect contain an authselect feature to easily and properly
enable pam_pwhistory.so module. If this feature is not yet available in your
system, an authselect custom profile must be used to avoid integrity issues in PAM files. |
Check pam_pwhistory.so presence in /etc/pam.d/system-auth oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_password_pam_pwhistory_remember_system_auth:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance | |||||
|---|---|---|---|---|---|---|---|
| /etc/pam.d/system-auth | 1 |
Check remember parameter is present and correct in /etc/pam.d/system-auth oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth_pamd:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_password_pam_pwhistory_remember_system_auth_pamd:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance | ||
|---|---|---|---|---|
| /etc/pam.d/system-auth | 1 |
Check the absence of remember parameter in /etc/security/pwhistory.conf oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth_no_pwhistory_conf:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_password_pam_pwhistory_remember_system_auth_param_conf:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^\s*remember\s*=\s*([0-9]+) | ^/etc/security/pwhistory.conf$ | 1 |
Check remember parameter is absent in /etc/pam.d/system-auth oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth_no_pamd:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_password_pam_pwhistory_remember_system_auth_pamd:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^\s*password\b.*\bpam_pwhistory\.so\b.*\bremember=([0-9]*).*$ | /etc/pam.d/system-auth | 1 |
Check remember parameter is present and correct in /etc/security/pwhistory.conf oval:ssg-test_accounts_password_pam_pwhistory_remember_system_auth_pwhistory_conf:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_password_pam_pwhistory_remember_system_auth_param_conf:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance | ||
|---|---|---|---|---|
| ^/etc/security/pwhistory.conf$ | 1 |
Lock Accounts After Failed Password Attempts
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_deny |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_passwords_pam_faillock_deny:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83587-6 References: BP28(R18), 1, 12, 15, 16, 5.5.3, DSS05.04, DSS05.10, DSS06.10, 3.1.8, CCI-000044, CCI-002236, CCI-002237, CCI-002238, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, CM-6(a), AC-7(a), PR.AC-7, FIA_AFL.1, Req-8.1.6, SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005, SRG-OS-000021-VMM-000050, 5.4.2, 5.5.2 |
| Description | This rule configures the system to lock out accounts after a number of incorrect login attempts
using pam_faillock.so.
pam_faillock.so module requires multiple entries in pam files. These entries must be carefully
defined to work as expected.
In order to avoid errors when manually editing these files, it is
recommended to use the appropriate tools, such as authselect or authconfig,
depending on the OS version. |
| Rationale | By limiting the number of failed logon attempts, the risk of unauthorized system access via
user password guessing, also known as brute-forcing, is reduced. Limits are imposed by locking
the account. |
| Warnings | warning
If the system relies on authselect tool to manage PAM settings, the remediation
will also use authselect tool. However, if any manual modification was made in
PAM files, the authselect integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.
If the system supports the /etc/security/faillock.conf file, the pam_faillock
parameters should be defined in faillock.conf file. |
No more than one pam_unix.so is expected in auth section of system-auth oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_unix_auth:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_deny_system_pam_unix_auth:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^[\s]*auth\N+pam_unix\.so | ^/etc/pam.d/system-auth$ | 1 |
No more than one pam_unix.so is expected in auth section of password-auth oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_unix_auth:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_deny_password_pam_unix_auth:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^[\s]*auth\N+pam_unix\.so | ^/etc/pam.d/password-auth$ | 1 |
One and only one occurrence is expected in auth section of system-auth oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_faillock_auth:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_deny_system_pam_faillock_auth:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail | ^/etc/pam.d/system-auth$ | 1 |
One and only one occurrence is expected in auth section of system-auth oval:ssg-test_accounts_passwords_pam_faillock_deny_system_pam_faillock_account:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_deny_system_pam_faillock_account:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so | ^/etc/pam.d/system-auth$ | 1 |
One and only one occurrence is expected in auth section of password-auth oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_faillock_auth:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_deny_password_pam_faillock_auth:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail | ^/etc/pam.d/password-auth$ | 1 |
One and only one occurrence is expected in auth section of password-auth oval:ssg-test_accounts_passwords_pam_faillock_deny_password_pam_faillock_account:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_deny_password_pam_faillock_account:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so | ^/etc/pam.d/password-auth$ | 1 |
Check the expected deny value in system-auth oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_pamd_system:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_system:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance | ||
|---|---|---|---|---|
| ^/etc/pam.d/system-auth$ | 1 |
Check the expected deny value in password-auth oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_pamd_password:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_password:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance | ||
|---|---|---|---|---|
| ^/etc/pam.d/password-auth$ | 1 |
Check the absence of deny parameter in /etc/security/faillock.conf oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_faillock_conf:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_faillock_conf:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^[\s]*deny[\s]*=[\s]*([0-9]+) | ^/etc/security/faillock.conf$ | 1 |
Check the absence of deny parameter in system-auth oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_pamd_system:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_system:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*deny=([0-9]+) | ^/etc/pam.d/system-auth$ | 1 |
Check the absence of deny parameter in password-auth oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_no_pamd_password:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_pamd_password:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*deny=([0-9]+) | ^/etc/pam.d/password-auth$ | 1 |
Check the expected deny value in in /etc/security/faillock.conf oval:ssg-test_accounts_passwords_pam_faillock_deny_parameter_faillock_conf:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_deny_parameter_faillock_conf:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance | ||
|---|---|---|---|---|
| ^/etc/security/faillock.conf$ | 1 |
Set Interval For Counting Failed Password Attempts
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_interval |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_passwords_pam_faillock_interval:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83583-5 References: BP28(R18), 1, 12, 15, 16, DSS05.04, DSS05.10, DSS06.10, CCI-000044, CCI-002236, CCI-002237, CCI-002238, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, CM-6(a), AC-7(a), PR.AC-7, FIA_AFL.1, SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005, SRG-OS-000021-VMM-000050 |
| Description | Utilizing pam_faillock.so, the fail_interval directive configures the system
to lock out an account after a number of incorrect login attempts within a specified time
period. |
| Rationale | By limiting the number of failed logon attempts the risk of unauthorized system
access via user password guessing, otherwise known as brute-forcing, is reduced.
Limits are imposed by locking the account. |
| Warnings | warning
If the system relies on authselect tool to manage PAM settings, the remediation
will also use authselect tool. However, if any manual modification was made in
PAM files, the authselect integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.
If the system supports the /etc/security/faillock.conf file, the pam_faillock
parameters should be defined in faillock.conf file. |
No more than one pam_unix.so is expected in auth section of system-auth oval:ssg-test_accounts_passwords_pam_faillock_interval_system_pam_unix_auth:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_interval_system_pam_unix_auth:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^[\s]*auth\N+pam_unix\.so | ^/etc/pam.d/system-auth$ | 1 |
No more than one pam_unix.so is expected in auth section of password-auth oval:ssg-test_accounts_passwords_pam_faillock_interval_password_pam_unix_auth:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_interval_password_pam_unix_auth:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^[\s]*auth\N+pam_unix\.so | ^/etc/pam.d/password-auth$ | 1 |
One and only one occurrence is expected in auth section of system-auth oval:ssg-test_accounts_passwords_pam_faillock_interval_system_pam_faillock_auth:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_interval_system_pam_faillock_auth:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail | ^/etc/pam.d/system-auth$ | 1 |
One and only one occurrence is expected in auth section of system-auth oval:ssg-test_accounts_passwords_pam_faillock_interval_system_pam_faillock_account:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_interval_system_pam_faillock_account:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so | ^/etc/pam.d/system-auth$ | 1 |
One and only one occurrence is expected in auth section of password-auth oval:ssg-test_accounts_passwords_pam_faillock_interval_password_pam_faillock_auth:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_interval_password_pam_faillock_auth:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail | ^/etc/pam.d/password-auth$ | 1 |
One and only one occurrence is expected in auth section of password-auth oval:ssg-test_accounts_passwords_pam_faillock_interval_password_pam_faillock_account:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_interval_password_pam_faillock_account:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so | ^/etc/pam.d/password-auth$ | 1 |
Check the expected fail_interval value in system-auth oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_pamd_system:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_interval_parameter_pamd_system:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance | ||
|---|---|---|---|---|
| ^/etc/pam.d/system-auth$ | 1 |
Check the expected fail_interval value in password-auth oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_pamd_password:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_interval_parameter_pamd_password:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance | ||
|---|---|---|---|---|
| ^/etc/pam.d/password-auth$ | 1 |
Check the absence of fail_interval parameter in /etc/security/faillock.conf oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_no_faillock_conf:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_interval_parameter_faillock_conf:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^[\s]*fail_interval[\s]*=[\s]*([0-9]+) | ^/etc/security/faillock.conf$ | 1 |
Check the absence of fail_interval parameter in system-auth oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_no_pamd_system:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_interval_parameter_pamd_system:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*fail_interval=([0-9]+) | ^/etc/pam.d/system-auth$ | 1 |
Check the absence of fail_interval parameter in password-auth oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_no_pamd_password:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_interval_parameter_pamd_password:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*fail_interval=([0-9]+) | ^/etc/pam.d/password-auth$ | 1 |
Check the expected fail_interval value in in /etc/security/faillock.conf oval:ssg-test_accounts_passwords_pam_faillock_interval_parameter_faillock_conf:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_interval_parameter_faillock_conf:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance | ||
|---|---|---|---|---|
| ^/etc/security/faillock.conf$ | 1 |
Set Lockout Time for Failed Password Attempts
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_passwords_pam_faillock_unlock_time |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_passwords_pam_faillock_unlock_time:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83588-4 References: BP28(R18), 1, 12, 15, 16, 5.5.3, DSS05.04, DSS05.10, DSS06.10, 3.1.8, CCI-000044, CCI-002236, CCI-002237, CCI-002238, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, CM-6(a), AC-7(b), PR.AC-7, FIA_AFL.1, Req-8.1.7, SRG-OS-000329-GPOS-00128, SRG-OS-000021-GPOS-00005, SRG-OS-000329-VMM-001180, 5.5.2 |
| Description | This rule configures the system to lock out accounts during a specified time period after a
number of incorrect login attempts using pam_faillock.so.
pam_faillock.so module requires multiple entries in pam files. These entries must be carefully
defined to work as expected. In order to avoid any errors when manually editing these files,
it is recommended to use the appropriate tools, such as authselect or authconfig,
depending on the OS version.
If unlock_time is set to 0, manual intervention by an administrator is required
to unlock a user. This should be done using the faillock tool. |
| Rationale | By limiting the number of failed logon attempts the risk of unauthorized system
access via user password guessing, otherwise known as brute-forcing, is reduced.
Limits are imposed by locking the account. |
| Warnings | warning
If the system supports the new /etc/security/faillock.conf file but the
pam_faillock.so parameters are defined directly in /etc/pam.d/system-auth and
/etc/pam.d/password-auth, the remediation will migrate the unlock_time parameter
to /etc/security/faillock.conf to ensure compatibility with authselect tool.
The parameters deny and fail_interval, if used, also have to be migrated
by their respective remediation.warning
If the system relies on authselect tool to manage PAM settings, the remediation
will also use authselect tool. However, if any manual modification was made in
PAM files, the authselect integrity check will fail and the remediation will be
aborted in order to preserve intentional changes. In this case, an informative message will
be shown in the remediation report.
If the system supports the /etc/security/faillock.conf file, the pam_faillock
parameters should be defined in faillock.conf file. |
No more than one pam_unix.so is expected in auth section of system-auth oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_unix_auth:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system_pam_unix_auth:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^[\s]*auth\N+pam_unix\.so | ^/etc/pam.d/system-auth$ | 1 |
No more than one pam_unix.so is expected in auth section of password-auth oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_unix_auth:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password_pam_unix_auth:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^[\s]*auth\N+pam_unix\.so | ^/etc/pam.d/password-auth$ | 1 |
One and only one occurrence is expected in auth section of system-auth oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_auth:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_auth:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail | ^/etc/pam.d/system-auth$ | 1 |
One and only one occurrence is expected in auth section of system-auth oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_account:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_system_pam_faillock_account:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so | ^/etc/pam.d/system-auth$ | 1 |
One and only one occurrence is expected in auth section of password-auth oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_auth:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_auth:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+preauth[\s\S]*^[\s]*auth[\s]+(sufficient|\[(?=.*\bsuccess=done\b)(?=.*?\bnew_authtok_reqd=done\b)(?=.*?\bdefault=ignore\b).*\])[\s]+pam_unix\.so[\s\S]*^[\s]*auth[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\w\d=]+authfail | ^/etc/pam.d/password-auth$ | 1 |
One and only one occurrence is expected in auth section of password-auth oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_account:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_password_pam_faillock_account:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_faillock\.so[\s\S]*^[\s]*account[\s]+(required|\[(?=.*?\bsuccess=ok\b)(?=.*?\bnew_authtok_reqd=ok\b)(?=.*?\bignore=ignore\b)(?=.*?\bdefault=bad\b).*\])[\s]+pam_unix\.so | ^/etc/pam.d/password-auth$ | 1 |
Check the expected unlock_time value in system-auth oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_system:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_system:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance | ||
|---|---|---|---|---|
| ^/etc/pam.d/system-auth$ | 1 |
Check the expected unlock_time value in password-auth oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_password:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_password:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance | ||
|---|---|---|---|---|
| ^/etc/pam.d/password-auth$ | 1 |
Check the absence of unlock_time parameter in /etc/security/faillock.conf oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_faillock_conf:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_faillock_conf:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^[\s]*unlock_time[\s]*=[\s]*([0-9]+) | ^/etc/security/faillock.conf$ | 1 |
Check the absence of unlock_time parameter in system-auth oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_pamd_system:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_system:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*unlock_time=([0-9]+) | ^/etc/pam.d/system-auth$ | 1 |
Check the absence of unlock_time parameter in password-auth oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_no_pamd_password:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_pamd_password:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^[\s]*auth[\s]+.+[\s]+pam_faillock.so[\s]+[^\n]*unlock_time=([0-9]+) | ^/etc/pam.d/password-auth$ | 1 |
Check the expected unlock_time value in in /etc/security/faillock.conf oval:ssg-test_accounts_passwords_pam_faillock_unlock_time_parameter_faillock_conf:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_passwords_pam_faillock_unlock_time_parameter_faillock_conf:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance | ||
|---|---|---|---|---|
| ^/etc/security/faillock.conf$ | 1 |
Ensure PAM Enforces Password Requirements - Minimum Different Categories
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_minclass |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_pam_minclass:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83563-7 References: 1, 12, 15, 16, 5, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, CCI-000195, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(c), IA-5(1)(a), CM-6(a), IA-5(4), PR.AC-1, PR.AC-6, PR.AC-7, SRG-OS-000072-GPOS-00040, 5.5.1 |
| Description | The pam_pwquality module's minclass parameter controls
requirements for usage of different character classes, or types, of character
that must exist in a password before it is considered valid. For example,
setting this value to three (3) requires that any password must have characters
from at least three different categories in order to be approved. The default
value is zero (0), meaning there are no required classes. There are four
categories available:
* Upper-case characters * Lower-case characters * Digits * Special characters (for example, punctuation)Modify the minclass setting in /etc/security/pwquality.conf entry
to require 4
differing categories of characters when changing passwords. |
| Rationale | Use of a complex password helps to increase the time and resources required to compromise the password.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts
at guessing and brute-force attacks.
Password complexity is one factor of several that determines how long it takes to crack a password. The more complex the password, the greater the number of possible combinations that need to be tested before the password is compromised. Requiring a minimum number of character categories makes password guessing attacks more difficult by ensuring a larger search space. |
check the configuration of /etc/pam.d/system-auth oval:ssg-test_password_pam_pwquality:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /etc/pam.d/system-auth | password requisite pam_pwquality.so local_users_only |
check the configuration of /etc/security/pwquality.conf oval:ssg-test_password_pam_pwquality_minclass:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_password_pam_pwquality_minclass:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/security/pwquality\.conf$ | ^\s*minclass[\s]*=[\s]*(-?\d+)(?:[\s]|$) | 1 |
Ensure PAM Enforces Password Requirements - Minimum Length
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_minlen |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_pam_minlen:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83579-3 References: BP28(R18), 1, 12, 15, 16, 5, 5.6.2.1.1, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, CCI-000205, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(c), IA-5(1)(a), CM-6(a), IA-5(4), PR.AC-1, PR.AC-6, PR.AC-7, FMT_SMF_EXT.1, Req-8.2.3, SRG-OS-000078-GPOS-00046, SRG-OS-000072-VMM-000390, SRG-OS-000078-VMM-000450, 5.5.1 |
| Description | The pam_pwquality module's minlen parameter controls requirements for
minimum characters required in a password. Add minlen=14
after pam_pwquality to set minimum password length requirements. |
| Rationale | The shorter the password, the lower the number of possible combinations
that need to be tested before the password is compromised.
Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password. |
check the configuration of /etc/pam.d/system-auth oval:ssg-test_password_pam_pwquality:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /etc/pam.d/system-auth | password requisite pam_pwquality.so local_users_only |
check the configuration of /etc/security/pwquality.conf oval:ssg-test_password_pam_pwquality_minlen:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_password_pam_pwquality_minlen:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/security/pwquality\.conf$ | ^\s*minlen[\s]*=[\s]*(-?\d+)(?:[\s]|$) | 1 |
Ensure PAM Enforces Password Requirements - Authentication Retry Prompts Permitted Per-Session
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_pam_retry |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_pam_retry:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83569-4 References: 1, 11, 12, 15, 16, 3, 5, 9, 5.5.3, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, CCI-000192, CCI-000366, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CM-6(a), AC-7(a), IA-5(4), PR.AC-1, PR.AC-6, PR.AC-7, PR.IP-1, FMT_MOF_EXT.1, SRG-OS-000069-GPOS-00037, SRG-OS-000480-GPOS-00227, 5.5.1 |
| Description | To configure the number of retry prompts that are permitted per-session:
Edit the /etc/security/pwquality.conf to include
retry=3, or a lower value if site
policy is more restrictive. The DoD requirement is a maximum of 3 prompts
per session. |
| Rationale | Setting the password retry prompts that are permitted on a per-session basis to a low value
requires some software, such as SSH, to re-connect. This can slow down and
draw additional attention to some types of password-guessing attacks. Note that this
is different from account lockout, which is provided by the pam_faillock module. |
check the configuration of /etc/pam.d/password-auth oval:ssg-test_password_pam_pwquality_retry_password_auth:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_password_pam_pwquality_retry_password_auth:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/pam.d/password-auth | ^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_pwquality\.so.*retry=([0-9]*).*$ | 1 |
check the configuration of /etc/pam.d/system-auth oval:ssg-test_password_pam_pwquality_retry_system_auth:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_password_pam_pwquality_retry_system_auth:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/pam.d/system-auth | ^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_pwquality\.so.*retry=([0-9]*).*$ | 1 |
check the configuration of /etc/pam.d/password-auth oval:ssg-test_password_pam_pwquality_retry_password_auth_not_set:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_password_pam_pwquality_retry_password_auth:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/pam.d/password-auth | ^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_pwquality\.so.*retry=([0-9]*).*$ | 1 |
check the configuration of /etc/pam.d/system-auth oval:ssg-test_password_pam_pwquality_retry_system_auth_not_set:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_password_pam_pwquality_retry_system_auth:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/pam.d/system-auth | ^\s*password\s+(?:(?:required)|(?:requisite))\s+pam_pwquality\.so.*retry=([0-9]*).*$ | 1 |
check the configuration of /etc/security/pwquality.conf oval:ssg-test_password_pam_pwquality_retry_pwquality_conf:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_password_pam_pwquality_retry_pwquality_conf:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/security/pwquality.conf | ^[\s]*retry[\s]*=[\s]*(\d+)(?:[\s]|$) | 1 |
Set PAM''s Password Hashing Algorithm - password-auth
| Rule ID | xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_passwordauth |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-set_password_hashing_algorithm_passwordauth:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-85946-2 References: BP28(R32), 1, 12, 15, 16, 5, 5.6.2.2, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.13.11, CCI-000196, CCI-000803, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, 0418, 1055, 1402, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(c), IA-5(1)(c), CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7, Req-8.2.1, SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061, SRG-OS-000480-VMM-002000, 5.5.4 |
| Description | The PAM system service can be configured to only store encrypted
representations of passwords. In
/etc/pam.d/password-auth,
the
password section of the file controls which PAM modules execute
during a password change. Set the pam_unix.so module in the
password section to include the argument sha512, as shown
below:
password sufficient pam_unix.so sha512 other arguments... This will help ensure when local users change their passwords, hashes for the new passwords will be generated using the SHA-512 algorithm. This is the default. |
| Rationale | Passwords need to be protected at all times, and encryption is the standard
method for protecting passwords. If passwords are not encrypted, they can
be plainly read (i.e., clear text) and easily compromised. Passwords that
are encrypted with a weak algorithm are no more protected than if they are
kepy in plain text.
This setting ensures user and group account administration utilities are configured to store only encrypted representations of passwords. Additionally, the crypt_style configuration option ensures the use
of a strong hashing algorithm that makes password cracking attacks more
difficult. |
check /etc/pam.d/password-auth for correct settings oval:ssg-test_pam_unix_passwordauth_sha512:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /etc/pam.d/password-auth | password sufficient pam_unix.so sha512 shadow nullok use_authtok |
Set PAM''s Password Hashing Algorithm
| Rule ID | xccdf_org.ssgproject.content_rule_set_password_hashing_algorithm_systemauth |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-set_password_hashing_algorithm_systemauth:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83581-9 References: BP28(R32), 1, 12, 15, 16, 5, 5.6.2.2, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.13.11, CCI-000196, CCI-000803, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, 0418, 1055, 1402, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(c), IA-5(1)(c), CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7, Req-8.2.1, SRG-OS-000073-GPOS-00041, SRG-OS-000120-GPOS-00061, SRG-OS-000480-VMM-002000, 5.5.4 |
| Description | The PAM system service can be configured to only store encrypted
representations of passwords. In "/etc/pam.d/system-auth", the
password section of the file controls which PAM modules execute
during a password change. Set the pam_unix.so module in the
password section to include the argument sha512, as shown
below:
password sufficient pam_unix.so sha512 other arguments... This will help ensure when local users change their passwords, hashes for the new passwords will be generated using the SHA-512 algorithm. This is the default. |
| Rationale | Passwords need to be protected at all times, and encryption is the standard
method for protecting passwords. If passwords are not encrypted, they can
be plainly read (i.e., clear text) and easily compromised. Passwords that
are encrypted with a weak algorithm are no more protected than if they are
kepy in plain text.
This setting ensures user and group account administration utilities are configured to store only encrypted representations of passwords. Additionally, the crypt_style configuration option ensures the use
of a strong hashing algorithm that makes password cracking attacks more
difficult. |
check /etc/pam.d/system-auth for correct settings oval:ssg-test_pam_unix_sha512:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /etc/pam.d/system-auth | password sufficient pam_unix.so sha512 shadow nullok use_authtok |
Set Account Expiration Following Inactivity
| Rule ID | xccdf_org.ssgproject.content_rule_account_disable_post_pw_expiration |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-account_disable_post_pw_expiration:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83627-0 References: 1, 12, 13, 14, 15, 16, 18, 3, 5, 7, 8, 5.6.2.1.1, DSS01.03, DSS03.05, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.5.6, CCI-000017, CCI-000795, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 6.2, A.12.4.1, A.12.4.3, A.18.1.4, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, CIP-004-6 R2.2.2, CIP-004-6 R2.2.3, CIP-007-3 R.1.3, CIP-007-3 R5, CIP-007-3 R5.1.1, CIP-007-3 R5.1.3, CIP-007-3 R5.2.1, CIP-007-3 R5.2.3, IA-4(e), AC-2(3), CM-6(a), DE.CM-1, DE.CM-3, PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, Req-8.1.4, SRG-OS-000118-GPOS-00060, SRG-OS-000003-VMM-000030, SRG-OS-000118-VMM-000590, 5.6.1.4 |
| Description | To specify the number of days after a password expires (which
signifies inactivity) until an account is permanently disabled, add or correct
the following line in /etc/default/useradd:
INACTIVE=30If a password is currently on the verge of expiration, then 30
day(s) remain(s) until the account is automatically
disabled. However, if the password will not expire for another 60 days, then 60
days plus 30 day(s) could
elapse until the account would be automatically disabled. See the
useradd man page for more information. |
| Rationale | Inactive identifiers pose a risk to systems and applications because attackers may exploit an inactive identifier and potentially obtain undetected access to the system.
Disabling inactive accounts ensures that accounts which may not have been responsibly removed are not available to attackers who may have compromised their credentials.
Owners of inactive accounts will not notice if unauthorized access to their user account has been obtained. |
the value INACTIVE parameter should be set appropriately in /etc/default/useradd oval:ssg-test_etc_default_useradd_inactive:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_etc_default_useradd_inactive:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/default/useradd | ^\s*INACTIVE\s*=\s*(\d+)\s*$ | 1 |
Ensure All Accounts on the System Have Unique Names
| Rule ID | xccdf_org.ssgproject.content_rule_account_unique_name |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-account_unique_name:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83628-8 References: 5.5.2, CCI-000770, CCI-000804, Req-8.1.1, 6.2.6 |
| Description | Ensure accounts on the system have unique names.
To ensure all accounts have unique names, run the following command:
$ sudo getent passwd | awk -F: '{ print $1}' | uniq -d
If a username is returned, change or delete the username. |
| Rationale | Unique usernames allow for accountability on the system. |
There should not exist duplicate user name entries in /etc/passwd oval:ssg-test_etc_passwd_no_duplicate_user_names:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-variable_count_of_all_usernames_from_etc_passwd:var:1 | 37 |
Set Password Maximum Age
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_maximum_age_login_defs |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_maximum_age_login_defs:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83606-4 References: BP28(R18), 1, 12, 15, 16, 5, 5.6.2.1, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.5.6, CCI-000199, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, 0418, 1055, 1402, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(f), IA-5(1)(d), CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7, Req-8.2.4, SRG-OS-000076-GPOS-00044, 5.6.1.1 |
| Description | To specify password maximum age for new accounts,
edit the file /etc/login.defs
and add or correct the following line:
PASS_MAX_DAYS 365A value of 180 days is sufficient for many environments. The DoD requirement is 60. The profile requirement is 365. |
| Rationale | Any password, no matter how complex, can eventually be cracked. Therefore, passwords
need to be changed periodically. If the operating system does not limit the lifetime
of passwords and force users to change their passwords, there is the risk that the
operating system passwords could be compromised.
Setting the password maximum age ensures users are required to periodically change their passwords. Requiring shorter password lifetimes increases the risk of users writing down the password in a convenient location subject to physical compromise. |
The value of PASS_MAX_DAYS should be set appropriately in /etc/login.defs oval:ssg-test_pass_max_days:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-variable_last_pass_max_days_instance_value:var:1 | 99999 |
Set Password Minimum Age
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_minimum_age_login_defs |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_minimum_age_login_defs:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83610-6 References: 1, 12, 15, 16, 5, 5.6.2.1.1, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.5.8, CCI-000198, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, 0418, 1055, 1402, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(f), IA-5(1)(d), CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7, Req-8.3.9, SRG-OS-000075-GPOS-00043, 5.6.1.2 |
| Description | To specify password minimum age for new accounts,
edit the file /etc/login.defs
and add or correct the following line:
PASS_MIN_DAYS 1A value of 1 day is considered sufficient for many environments. The DoD requirement is 1. The profile requirement is 1. |
| Rationale | Enforcing a minimum password lifetime helps to prevent repeated password
changes to defeat the password reuse or history enforcement requirement. If
users are allowed to immediately and continually change their password,
then the password could be repeatedly changed in a short period of time to
defeat the organization's policy regarding password reuse.
Setting the minimum password age protects against users cycling back to a favorite password after satisfying the password reuse requirement. |
The value of PASS_MIN_DAYS should be set appropriately in /etc/login.defs oval:ssg-test_pass_min_days:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-variable_last_pass_min_days_instance_value:var:1 | 0 |
Set Existing Passwords Maximum Age
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_set_max_life_existing |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_set_max_life_existing:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-86031-2 References: CCI-000199, IA-5(f), IA-5(1)(d), CM-6(a), SRG-OS-000076-GPOS-00044, SRG-OS-000076-VMM-000430, 5.6.1.1 |
| Description | Configure non-compliant accounts to enforce a 365-day maximum password lifetime
restriction by running the following command:
$ sudo chage -M 365 USER |
| Rationale | Any password, no matter how complex, can eventually be cracked. Therefore,
passwords need to be changed periodically. If the operating system does
not limit the lifetime of passwords and force users to change their
passwords, there is the risk that the operating system passwords could be
compromised. |
Password maximum lifetime for existing accounts is at least the minimum. oval:ssg-test_password_max_life_existing:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_shadow_password_users_max_life_existing:obj:1 of type shadow_object
| Username | Filter |
|---|---|
| .* | oval:ssg-filter_no_passwords_or_locked_accounts_max_life:ste:1 |
Password maximum life entry is at least a defined minimum oval:ssg-test_password_max_life_existing_minimum:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_shadow_password_users_max_life_existing:obj:1 of type shadow_object
| Username | Filter |
|---|---|
| .* | oval:ssg-filter_no_passwords_or_locked_accounts_max_life:ste:1 |
Set Existing Passwords Minimum Age
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_set_min_life_existing |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_set_min_life_existing:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-89069-9 References: CCI-000198, IA-5(f), IA-5(1)(d), CM-6(a), SRG-OS-000075-GPOS-00043, SRG-OS-000075-VMM000420, 5.6.1.2 |
| Description | Configure non-compliant accounts to enforce a 24 hours/1 day minimum password
lifetime by running the following command:
$ sudo chage -m 1 USER |
| Rationale | Enforcing a minimum password lifetime helps to prevent repeated password
changes to defeat the password reuse or history enforcement requirement. If
users are allowed to immediately and continually change their password, the
password could be repeatedly changed in a short period of time to defeat the
organization's policy regarding password reuse. |
Password minimum lifetime for existing accounts is at least what is defined by policy. oval:ssg-test_password_min_life_existing:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_shadow_password_users_min_life_existing:obj:1 of type shadow_object
| Username | Filter |
|---|---|
| .* | oval:ssg-filter_no_passwords_or_locked_accounts_min_life:ste:1 |
Password minimum life entry is at mosta defined maximum oval:ssg-test_password_min_life_existing_maximum:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_shadow_password_users_min_life_existing:obj:1 of type shadow_object
| Username | Filter |
|---|---|
| .* | oval:ssg-filter_no_passwords_or_locked_accounts_min_life:ste:1 |
Set Password Warning Age
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_warn_age_login_defs |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_warn_age_login_defs:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83609-8 References: 1, 12, 13, 14, 15, 16, 18, 3, 5, 7, 8, DSS01.03, DSS03.05, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.5.8, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 6.2, 0418, 1055, 1402, A.12.4.1, A.12.4.3, A.18.1.4, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, IA-5(f), IA-5(1)(d), CM-6(a), DE.CM-1, DE.CM-3, PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, Req-8.3.9, 5.6.1.3 |
| Description | To specify how many days prior to password
expiration that a warning will be issued to users,
edit the file /etc/login.defs and add or correct
the following line:
PASS_WARN_AGE 7The DoD requirement is 7. The profile requirement is 7. |
| Rationale | Setting the password warning age enables users to
make the change at a practical time. |
The value of PASS_WARN_AGE should be set appropriately in /etc/login.defs oval:ssg-test_pass_warn_age:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-variable_last_pass_warn_age_instance_value:var:1 | 7 |
Verify All Account Password Hashes are Shadowed
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_password_all_shadowed |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_password_all_shadowed:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83618-9 References: 1, 12, 15, 16, 5, 5.5.2, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.5.10, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, 1410, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, IA-5(h), CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7, Req-8.2.1, 6.2.1 |
| Description | If any password hashes are stored in /etc/passwd (in the second field,
instead of an x or *), the cause of this misconfiguration should be
investigated. The account should have its password reset and the hash should be
properly stored, or the account should be deleted entirely. |
| Rationale | The hashes for all user account passwords should be stored in
the file /etc/shadow and never in /etc/passwd,
which is readable by all users. |
password hashes are shadowed oval:ssg-test_accounts_password_all_shadowed:tst:1 true
Following items have been found on the system:
| Username | Password | User id | Group id | Gcos | Home dir | Login shell | Last login |
|---|---|---|---|---|---|---|---|
| root | 0 | 0 | root | /root | /bin/bash | 1688737576 | |
| bin | 1 | 1 | bin | /bin | /sbin/nologin | 0 | |
| daemon | 2 | 2 | daemon | /sbin | /sbin/nologin | 0 | |
| adm | 3 | 4 | adm | /var/adm | /sbin/nologin | 0 | |
| lp | 4 | 7 | lp | /var/spool/lpd | /sbin/nologin | 0 | |
| sync | 5 | 0 | sync | /sbin | /bin/sync | 0 | |
| shutdown | 6 | 0 | shutdown | /sbin | /sbin/shutdown | 0 | |
| halt | 7 | 0 | halt | /sbin | /sbin/halt | 0 | |
| 8 | 12 | /var/spool/mail | /sbin/nologin | 0 | |||
| operator | 11 | 0 | operator | /root | /sbin/nologin | 0 | |
| games | 12 | 100 | games | /usr/games | /sbin/nologin | 0 | |
| ftp | 14 | 50 | FTP User | /var/ftp | /sbin/nologin | 0 | |
| nobody | 65534 | 65534 | Kernel Overflow User | / | /sbin/nologin | -1 | |
| systemd-coredump | 999 | 997 | systemd Core Dumper | / | /sbin/nologin | 0 | |
| dbus | 81 | 81 | System message bus | / | /sbin/nologin | 0 | |
| polkitd | 998 | 996 | User for polkitd | / | /sbin/nologin | 0 | |
| avahi | 70 | 70 | Avahi mDNS/DNS-SD Stack | /var/run/avahi-daemon | /sbin/nologin | 0 | |
| tss | 59 | 59 | Account used for TPM access | /dev/null | /sbin/nologin | 0 | |
| colord | 997 | 993 | User for colord | /var/lib/colord | /sbin/nologin | 0 | |
| clevis | 996 | 992 | Clevis Decryption Framework unprivileged user | /var/cache/clevis | /usr/sbin/nologin | 0 | |
| rtkit | 172 | 172 | RealtimeKit | /proc | /sbin/nologin | 0 | |
| sssd | 995 | 991 | User for sssd | / | /sbin/nologin | 0 | |
| geoclue | 994 | 990 | User for geoclue | /var/lib/geoclue | /sbin/nologin | 0 | |
| libstoragemgmt | 988 | 988 | daemon account for libstoragemgmt | / | /usr/sbin/nologin | 0 | |
| systemd-oom | 987 | 987 | systemd Userspace OOM Killer | / | /usr/sbin/nologin | 0 | |
| setroubleshoot | 986 | 986 | SELinux troubleshoot server | /var/lib/setroubleshoot | /sbin/nologin | 0 | |
| pipewire | 985 | 984 | PipeWire System Daemon | /var/run/pipewire | /sbin/nologin | 0 | |
| flatpak | 984 | 983 | User for flatpak system helper | / | /sbin/nologin | 0 | |
| gdm | 42 | 42 | /var/lib/gdm | /sbin/nologin | 1688975100 | ||
| cockpit-ws | 983 | 982 | User for cockpit web service | /nonexisting | /sbin/nologin | 0 | |
| cockpit-wsinstance | 982 | 981 | User for cockpit-ws instances | /nonexisting | /sbin/nologin | 0 | |
| gnome-initial-setup | 981 | 980 | /run/gnome-initial-setup/ | /sbin/nologin | 0 | ||
| sshd | 74 | 74 | Privilege-separated SSH | /usr/share/empty.sshd | /sbin/nologin | 0 | |
| chrony | 980 | 979 | chrony system user | /var/lib/chrony | /sbin/nologin | 0 | |
| dnsmasq | 979 | 978 | Dnsmasq DHCP and DNS server | /var/lib/dnsmasq | /sbin/nologin | 0 | |
| tcpdump | 72 | 72 | / | /sbin/nologin | 0 | ||
| inx | 1000 | 1000 | inx | /home/inx | /bin/bash | 1688978007 |
All GIDs referenced in /etc/passwd must be defined in /etc/group
| Rule ID | xccdf_org.ssgproject.content_rule_gid_passwd_group_same |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-gid_passwd_group_same:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | low |
| Identifiers and References | Identifiers: CCE-83613-0 References: 1, 12, 15, 16, 5, 5.5.2, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, CCI-000764, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, A.18.1.4, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, IA-2, CM-6(a), PR.AC-1, PR.AC-6, PR.AC-7, Req-8.5.a, SRG-OS-000104-GPOS-00051, 6.2.3 |
| Description | Add a group to the system for each GID referenced without a corresponding group. |
| Rationale | If a user is assigned the Group Identifier (GID) of a group not existing on the system, and a group
with the Group Identifier (GID) is subsequently created, the user may have unintended rights to
any files associated with the group. |
Verify all GIDs referenced in /etc/passwd are defined in /etc/group oval:ssg-test_gid_passwd_group_same:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /etc/passwd | root:x:0:0: |
| /etc/passwd | tss:x:59:59: |
| /etc/passwd | mail:x:8:12: |
| /etc/passwd | pipewire:x:985:984: |
| /etc/passwd | flatpak:x:984:983: |
| /etc/passwd | gdm:x:42:42: |
| /etc/passwd | cockpit-ws:x:983:982: |
| /etc/passwd | cockpit-wsinstance:x:982:981: |
| /etc/passwd | gnome-initial-setup:x:981:980: |
| /etc/passwd | sshd:x:74:74: |
| /etc/passwd | chrony:x:980:979: |
| /etc/passwd | dnsmasq:x:979:978: |
| /etc/passwd | tcpdump:x:72:72: |
| /etc/passwd | inx:x:1000:1000: |
| /etc/passwd | dbus:x:81:81: |
| /etc/passwd | polkitd:x:998:996: |
| /etc/passwd | colord:x:997:993: |
| /etc/passwd | clevis:x:996:992: |
| /etc/passwd | rtkit:x:172:172: |
| /etc/passwd | sssd:x:995:991: |
| /etc/passwd | geoclue:x:994:990: |
| /etc/passwd | libstoragemgmt:x:988:988: |
| /etc/passwd | systemd-oom:x:987:987: |
| /etc/passwd | setroubleshoot:x:986:986: |
| /etc/passwd | lp:x:4:7: |
| /etc/passwd | systemd-coredump:x:999:997: |
| /etc/passwd | bin:x:1:1: |
| /etc/passwd | ftp:x:14:50: |
| /etc/passwd | avahi:x:70:70: |
| /etc/passwd | operator:x:11:0: |
| /etc/passwd | adm:x:3:4: |
| /etc/passwd | halt:x:7:0: |
| /etc/passwd | daemon:x:2:2: |
| /etc/passwd | shutdown:x:6:0: |
| /etc/passwd | nobody:x:65534:65534: |
| /etc/passwd | sync:x:5:0: |
| /etc/passwd | games:x:12:100: |
Ensure There Are No Accounts With Blank or Null Passwords
| Rule ID | xccdf_org.ssgproject.content_rule_no_empty_passwords_etc_shadow |
| Result | error |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-no_empty_passwords_etc_shadow:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | high |
| Identifiers and References | Identifiers: CCE-85972-8 References: CCI-000366, CM-6(b), CM-6.1(iv), SRG-OS-000480-GPOS-00227, 5.6.6, 6.2.2 |
| Description | Check the "/etc/shadow" file for blank passwords with the
following command:
$ sudo awk -F: '!$2 {print $1}' /etc/shadow
If the command returns any results, this is a finding.
Configure all accounts on the system to have a password or lock
the account with the following commands:
Perform a password reset:
$ sudo passwd [username]Lock an account: $ sudo passwd -l [username] |
| Rationale | If an account has an empty password, anyone could log in and
run commands with the privileges of that account. Accounts with
empty passwords should never be used in operational environments. |
| Warnings | warning
Note that this rule is not applicable for systems running within a container. Having user with empty password within a container is not considered a risk, because it should not be possible to directly login into a container anyway. |
make sure there aren't blank or null passwords in /etc/shadow oval:ssg-test_no_empty_passwords_etc_shadow:tst:1 error
No items have been found conforming to the following objects:
Object oval:ssg-obj_no_empty_passwords_etc_shadow:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/shadow | ^[^:]+::.*$ | 1 |
Verify No netrc Files Exist
| Rule ID | xccdf_org.ssgproject.content_rule_no_netrc_files |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-no_netrc_files:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83617-1 References: 1, 11, 12, 14, 15, 16, 18, 3, 5, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.06, DSS06.10, CCI-000196, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, A.18.1.4, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, CIP-003-8 R1.3, CIP-003-8 R3, CIP-003-8 R3.1, CIP-003-8 R3.2, CIP-003-8 R3.3, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, IA-5(h), IA-5(1)(c), CM-6(a), IA-5(7), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.PT-3, 6.2.13 |
| Description | The .netrc files contain login information
used to auto-login into FTP servers and reside in the user's home
directory. These files may contain unencrypted passwords to
remote FTP servers making them susceptible to access by unauthorized
users and should not be used. Any .netrc files should be removed. |
| Rationale | Unencrypted passwords for remote FTP servers may be stored in .netrc
files. |
look for .netrc in /home oval:ssg-test_no_netrc_files_home:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_no_netrc_files_home:obj:1 of type file_object
| Behaviors | Path | Filename |
|---|---|---|
| no value | /home | ^\.netrc$ |
Verify Only Root Has UID 0
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_no_uid_except_zero |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_no_uid_except_zero:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | high |
| Identifiers and References | Identifiers: CCE-83624-7 References: 1, 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.02, DSS06.03, DSS06.10, 3.1.1, 3.1.5, CCI-000366, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.18.1.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, IA-2, AC-6(5), IA-4(b), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.DS-5, Req-8.2.1, SRG-OS-000480-GPOS-00227, 6.2.9 |
| Description | If any account other than root has a UID of 0, this misconfiguration should
be investigated and the accounts other than root should be removed or have
their UID changed.
If the account is associated with system commands or applications the UID should be changed to one greater than "0" but less than "1000." Otherwise assign a UID greater than "1000" that has not already been assigned. |
| Rationale | An account has root authority if it has a UID of 0. Multiple accounts
with a UID of 0 afford more opportunity for potential intruders to
guess a password for a privileged account. Proper configuration of
sudo is recommended to afford multiple system administrators
access to root privileges in an accountable manner. |
test that there are no accounts with UID 0 except root in the /etc/passwd file oval:ssg-test_accounts_no_uid_except_root:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_no_uid_except_root:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/passwd | ^(?!root:)[^:]*:[^:]*:0 | 1 |
Verify Root Has A Primary GID 0
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_root_gid_zero |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_root_gid_zero:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | high |
| Identifiers and References | Identifiers: CCE-86298-7 |
| Description | The root user should have a primary group of 0. |
| Rationale | To help ensure that root-owned files are not inadvertently exposed to other users. |
test that there are no accounts with UID 0 except root in the /etc/passwd file oval:ssg-test_accounts_root_gid_zero:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /etc/passwd | root:x:0:0:root:/root:/bin/bash |
Ensure that System Accounts Do Not Run a Shell Upon Login
| Rule ID | xccdf_org.ssgproject.content_rule_no_shelllogin_for_systemaccounts |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-no_shelllogin_for_systemaccounts:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83623-9 References: 1, 12, 13, 14, 15, 16, 18, 3, 5, 7, 8, DSS01.03, DSS03.05, DSS05.04, DSS05.05, DSS05.07, DSS06.03, CCI-000366, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 6.2, 1491, A.12.4.1, A.12.4.3, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, AC-6, CM-6(a), CM-6(b), CM-6.1(iv), DE.CM-1, DE.CM-3, PR.AC-1, PR.AC-4, PR.AC-6, Req-8.6.1, SRG-OS-000480-GPOS-00227, 5.6.2 |
| Description | Some accounts are not associated with a human user of the system, and exist to
perform some administrative function. Should an attacker be able to log into
these accounts, they should not be granted access to a shell.
The login shell for each local account is stored in the last field of each line in /etc/passwd. System accounts are those user accounts with a user ID
less than UID_MIN, where value of UID_MIN directive is set in
/etc/login.defs configuration file. In the default configuration UID_MIN is set
to 1000, thus system accounts are those user accounts with a user ID less than
1000. The user ID is stored in the third field. If any system account
SYSACCT (other than root) has a login shell, disable it with the
command: $ sudo usermod -s /sbin/nologin SYSACCT |
| Rationale | Ensuring shells are not given to system accounts upon login makes it more
difficult for attackers to make use of system accounts. |
| Warnings | warning
Do not perform the steps in this section on the root account. Doing so might
cause the system to become inaccessible. |
SYS_UID_MIN not defined in /etc/login.defs oval:ssg-test_sys_uid_min_not_defined:tst:1 false
Following items have been found on the system:
| Path | Content |
|---|---|
| /etc/login.defs | # # Please note that the parameters in this configuration file control the # behavior of the tools from the shadow-utils component. None of these # tools uses the PAM mechanism, and the utilities that use PAM (such as the # passwd command) should therefore be configured elsewhere. Refer to # /etc/pam.d/system-auth for more information. # # # Delay in seconds before being allowed another attempt after a login failure # Note: When PAM is used, some modules may enforce a minimum delay (e.g. # pam_unix(8) enforces a 2s delay) # #FAIL_DELAY 3 # Currently FAILLOG_ENAB is not supported # # Enable display of unknown usernames when login(1) failures are recorded. # #LOG_UNKFAIL_ENAB no # Currently LOG_OK_LOGINS is not supported # Currently LASTLOG_ENAB is not supported # # Limit the highest user ID number for which the lastlog entries should # be updated. # # No LASTLOG_UID_MAX means that there is no user ID limit for writing # lastlog entries. # #LASTLOG_UID_MAX # Currently MAIL_CHECK_ENAB is not supported # Currently OBSCURE_CHECKS_ENAB is not supported # Currently PORTTIME_CHECKS_ENAB is not supported # Currently QUOTAS_ENAB is not supported # Currently SYSLOG_SU_ENAB is not supported # # Enable "syslog" logging of newgrp(1) and sg(1) activity. # #SYSLOG_SG_ENAB yes # Currently CONSOLE is not supported # Currently SULOG_FILE is not supported # Currently MOTD_FILE is not supported # Currently ISSUE_FILE is not supported # Currently TTYTYPE_FILE is not supported # Currently FTMP_FILE is not supported # Currently NOLOGINS_FILE is not supported # Currently SU_NAME is not supported # *REQUIRED* # Directory where mailboxes reside, _or_ name of file, relative to the # home directory. If you _do_ define both, MAIL_DIR takes precedence. # MAIL_DIR /var/spool/mail #MAIL_FILE .mail # # If defined, file which inhibits all the usual chatter during the login # sequence. If a full pathname, then hushed mode will be enabled if the # user's name or shell are found in the file. If not a full pathname, then # hushed mode will be enabled if the file exists in the user's home directory. # #HUSHLOGIN_FILE .hushlogin #HUSHLOGIN_FILE /etc/hushlogins # Currently ENV_TZ is not supported # Currently ENV_HZ is not supported # # The default PATH settings, for superuser and normal users. # # (they are minimal, add the rest in the shell startup files) #ENV_SUPATH PATH=/sbin:/bin:/usr/sbin:/usr/bin #ENV_PATH PATH=/bin:/usr/bin # # Terminal permissions # # TTYGROUP Login tty will be assigned this group ownership. # TTYPERM Login tty will be set to this permission. # # If you have a write(1) program which is "setgid" to a special group # which owns the terminals, define TTYGROUP as the number of such group # and TTYPERM as 0620. Otherwise leave TTYGROUP commented out and # set TTYPERM to either 622 or 600. # #TTYGROUP tty #TTYPERM 0600 # Currently ERASECHAR, KILLCHAR and ULIMIT are not supported # Default initial "umask" value used by login(1) on non-PAM enabled systems. # Default "umask" value for pam_umask(8) on PAM enabled systems. # UMASK is also used by useradd(8) and newusers(8) to set the mode for new # home directories if HOME_MODE is not set. # 022 is the default value, but 027, or even 077, could be considered # for increased privacy. There is no One True Answer here: each sysadmin # must make up their mind. UMASK 022 # HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new # home directories. # If HOME_MODE is not set, the value of UMASK is used to create the mode. HOME_MODE 0700 # Password aging controls: # # PASS_MAX_DAYS Maximum number of days a password may be used. # PASS_MIN_DAYS Minimum number of days allowed between password changes. # PASS_MIN_LEN Minimum acceptable password length. # PASS_WARN_AGE Number of days warning given before a password expires. # PASS_MAX_DAYS 99999 PASS_MIN_DAYS 0 PASS_WARN_AGE 7 # Currently PASS_MIN_LEN is not supported # Currently SU_WHEEL_ONLY is not supported # Currently CRACKLIB_DICTPATH is not supported # # Min/max values for automatic uid selection in useradd(8) # UID_MIN 1000 UID_MAX 60000 # System accounts SYS_UID_MIN 201 |
SYS_UID_MAX not defined in /etc/login.defs oval:ssg-test_sys_uid_max_not_defined:tst:1 false
Following items have been found on the system:
| Path | Content |
|---|---|
| /etc/login.defs | # # Please note that the parameters in this configuration file control the # behavior of the tools from the shadow-utils component. None of these # tools uses the PAM mechanism, and the utilities that use PAM (such as the # passwd command) should therefore be configured elsewhere. Refer to # /etc/pam.d/system-auth for more information. # # # Delay in seconds before being allowed another attempt after a login failure # Note: When PAM is used, some modules may enforce a minimum delay (e.g. # pam_unix(8) enforces a 2s delay) # #FAIL_DELAY 3 # Currently FAILLOG_ENAB is not supported # # Enable display of unknown usernames when login(1) failures are recorded. # #LOG_UNKFAIL_ENAB no # Currently LOG_OK_LOGINS is not supported # Currently LASTLOG_ENAB is not supported # # Limit the highest user ID number for which the lastlog entries should # be updated. # # No LASTLOG_UID_MAX means that there is no user ID limit for writing # lastlog entries. # #LASTLOG_UID_MAX # Currently MAIL_CHECK_ENAB is not supported # Currently OBSCURE_CHECKS_ENAB is not supported # Currently PORTTIME_CHECKS_ENAB is not supported # Currently QUOTAS_ENAB is not supported # Currently SYSLOG_SU_ENAB is not supported # # Enable "syslog" logging of newgrp(1) and sg(1) activity. # #SYSLOG_SG_ENAB yes # Currently CONSOLE is not supported # Currently SULOG_FILE is not supported # Currently MOTD_FILE is not supported # Currently ISSUE_FILE is not supported # Currently TTYTYPE_FILE is not supported # Currently FTMP_FILE is not supported # Currently NOLOGINS_FILE is not supported # Currently SU_NAME is not supported # *REQUIRED* # Directory where mailboxes reside, _or_ name of file, relative to the # home directory. If you _do_ define both, MAIL_DIR takes precedence. # MAIL_DIR /var/spool/mail #MAIL_FILE .mail # # If defined, file which inhibits all the usual chatter during the login # sequence. If a full pathname, then hushed mode will be enabled if the # user's name or shell are found in the file. If not a full pathname, then # hushed mode will be enabled if the file exists in the user's home directory. # #HUSHLOGIN_FILE .hushlogin #HUSHLOGIN_FILE /etc/hushlogins # Currently ENV_TZ is not supported # Currently ENV_HZ is not supported # # The default PATH settings, for superuser and normal users. # # (they are minimal, add the rest in the shell startup files) #ENV_SUPATH PATH=/sbin:/bin:/usr/sbin:/usr/bin #ENV_PATH PATH=/bin:/usr/bin # # Terminal permissions # # TTYGROUP Login tty will be assigned this group ownership. # TTYPERM Login tty will be set to this permission. # # If you have a write(1) program which is "setgid" to a special group # which owns the terminals, define TTYGROUP as the number of such group # and TTYPERM as 0620. Otherwise leave TTYGROUP commented out and # set TTYPERM to either 622 or 600. # #TTYGROUP tty #TTYPERM 0600 # Currently ERASECHAR, KILLCHAR and ULIMIT are not supported # Default initial "umask" value used by login(1) on non-PAM enabled systems. # Default "umask" value for pam_umask(8) on PAM enabled systems. # UMASK is also used by useradd(8) and newusers(8) to set the mode for new # home directories if HOME_MODE is not set. # 022 is the default value, but 027, or even 077, could be considered # for increased privacy. There is no One True Answer here: each sysadmin # must make up their mind. UMASK 022 # HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new # home directories. # If HOME_MODE is not set, the value of UMASK is used to create the mode. HOME_MODE 0700 # Password aging controls: # # PASS_MAX_DAYS Maximum number of days a password may be used. # PASS_MIN_DAYS Minimum number of days allowed between password changes. # PASS_MIN_LEN Minimum acceptable password length. # PASS_WARN_AGE Number of days warning given before a password expires. # PASS_MAX_DAYS 99999 PASS_MIN_DAYS 0 PASS_WARN_AGE 7 # Currently PASS_MIN_LEN is not supported # Currently SU_WHEEL_ONLY is not supported # Currently CRACKLIB_DICTPATH is not supported # # Min/max values for automatic uid selection in useradd(8) # UID_MIN 1000 UID_MAX 60000 # System accounts SYS_UID_MIN 201 SYS_UID_MAX 999 |
<0, UID_MIN - 1> system UIDs having shell set oval:ssg-test_shell_defined_default_uid_range:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /etc/passwd | inx:x:1000:1000:inx:/home/inx:/bin/bash |
SYS_UID_MIN not defined in /etc/login.defs oval:ssg-test_sys_uid_min_not_defined:tst:1 false
Following items have been found on the system:
| Path | Content |
|---|---|
| /etc/login.defs | # # Please note that the parameters in this configuration file control the # behavior of the tools from the shadow-utils component. None of these # tools uses the PAM mechanism, and the utilities that use PAM (such as the # passwd command) should therefore be configured elsewhere. Refer to # /etc/pam.d/system-auth for more information. # # # Delay in seconds before being allowed another attempt after a login failure # Note: When PAM is used, some modules may enforce a minimum delay (e.g. # pam_unix(8) enforces a 2s delay) # #FAIL_DELAY 3 # Currently FAILLOG_ENAB is not supported # # Enable display of unknown usernames when login(1) failures are recorded. # #LOG_UNKFAIL_ENAB no # Currently LOG_OK_LOGINS is not supported # Currently LASTLOG_ENAB is not supported # # Limit the highest user ID number for which the lastlog entries should # be updated. # # No LASTLOG_UID_MAX means that there is no user ID limit for writing # lastlog entries. # #LASTLOG_UID_MAX # Currently MAIL_CHECK_ENAB is not supported # Currently OBSCURE_CHECKS_ENAB is not supported # Currently PORTTIME_CHECKS_ENAB is not supported # Currently QUOTAS_ENAB is not supported # Currently SYSLOG_SU_ENAB is not supported # # Enable "syslog" logging of newgrp(1) and sg(1) activity. # #SYSLOG_SG_ENAB yes # Currently CONSOLE is not supported # Currently SULOG_FILE is not supported # Currently MOTD_FILE is not supported # Currently ISSUE_FILE is not supported # Currently TTYTYPE_FILE is not supported # Currently FTMP_FILE is not supported # Currently NOLOGINS_FILE is not supported # Currently SU_NAME is not supported # *REQUIRED* # Directory where mailboxes reside, _or_ name of file, relative to the # home directory. If you _do_ define both, MAIL_DIR takes precedence. # MAIL_DIR /var/spool/mail #MAIL_FILE .mail # # If defined, file which inhibits all the usual chatter during the login # sequence. If a full pathname, then hushed mode will be enabled if the # user's name or shell are found in the file. If not a full pathname, then # hushed mode will be enabled if the file exists in the user's home directory. # #HUSHLOGIN_FILE .hushlogin #HUSHLOGIN_FILE /etc/hushlogins # Currently ENV_TZ is not supported # Currently ENV_HZ is not supported # # The default PATH settings, for superuser and normal users. # # (they are minimal, add the rest in the shell startup files) #ENV_SUPATH PATH=/sbin:/bin:/usr/sbin:/usr/bin #ENV_PATH PATH=/bin:/usr/bin # # Terminal permissions # # TTYGROUP Login tty will be assigned this group ownership. # TTYPERM Login tty will be set to this permission. # # If you have a write(1) program which is "setgid" to a special group # which owns the terminals, define TTYGROUP as the number of such group # and TTYPERM as 0620. Otherwise leave TTYGROUP commented out and # set TTYPERM to either 622 or 600. # #TTYGROUP tty #TTYPERM 0600 # Currently ERASECHAR, KILLCHAR and ULIMIT are not supported # Default initial "umask" value used by login(1) on non-PAM enabled systems. # Default "umask" value for pam_umask(8) on PAM enabled systems. # UMASK is also used by useradd(8) and newusers(8) to set the mode for new # home directories if HOME_MODE is not set. # 022 is the default value, but 027, or even 077, could be considered # for increased privacy. There is no One True Answer here: each sysadmin # must make up their mind. UMASK 022 # HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new # home directories. # If HOME_MODE is not set, the value of UMASK is used to create the mode. HOME_MODE 0700 # Password aging controls: # # PASS_MAX_DAYS Maximum number of days a password may be used. # PASS_MIN_DAYS Minimum number of days allowed between password changes. # PASS_MIN_LEN Minimum acceptable password length. # PASS_WARN_AGE Number of days warning given before a password expires. # PASS_MAX_DAYS 99999 PASS_MIN_DAYS 0 PASS_WARN_AGE 7 # Currently PASS_MIN_LEN is not supported # Currently SU_WHEEL_ONLY is not supported # Currently CRACKLIB_DICTPATH is not supported # # Min/max values for automatic uid selection in useradd(8) # UID_MIN 1000 UID_MAX 60000 # System accounts SYS_UID_MIN 201 |
SYS_UID_MAX not defined in /etc/login.defs oval:ssg-test_sys_uid_max_not_defined:tst:1 false
Following items have been found on the system:
| Path | Content |
|---|---|
| /etc/login.defs | # # Please note that the parameters in this configuration file control the # behavior of the tools from the shadow-utils component. None of these # tools uses the PAM mechanism, and the utilities that use PAM (such as the # passwd command) should therefore be configured elsewhere. Refer to # /etc/pam.d/system-auth for more information. # # # Delay in seconds before being allowed another attempt after a login failure # Note: When PAM is used, some modules may enforce a minimum delay (e.g. # pam_unix(8) enforces a 2s delay) # #FAIL_DELAY 3 # Currently FAILLOG_ENAB is not supported # # Enable display of unknown usernames when login(1) failures are recorded. # #LOG_UNKFAIL_ENAB no # Currently LOG_OK_LOGINS is not supported # Currently LASTLOG_ENAB is not supported # # Limit the highest user ID number for which the lastlog entries should # be updated. # # No LASTLOG_UID_MAX means that there is no user ID limit for writing # lastlog entries. # #LASTLOG_UID_MAX # Currently MAIL_CHECK_ENAB is not supported # Currently OBSCURE_CHECKS_ENAB is not supported # Currently PORTTIME_CHECKS_ENAB is not supported # Currently QUOTAS_ENAB is not supported # Currently SYSLOG_SU_ENAB is not supported # # Enable "syslog" logging of newgrp(1) and sg(1) activity. # #SYSLOG_SG_ENAB yes # Currently CONSOLE is not supported # Currently SULOG_FILE is not supported # Currently MOTD_FILE is not supported # Currently ISSUE_FILE is not supported # Currently TTYTYPE_FILE is not supported # Currently FTMP_FILE is not supported # Currently NOLOGINS_FILE is not supported # Currently SU_NAME is not supported # *REQUIRED* # Directory where mailboxes reside, _or_ name of file, relative to the # home directory. If you _do_ define both, MAIL_DIR takes precedence. # MAIL_DIR /var/spool/mail #MAIL_FILE .mail # # If defined, file which inhibits all the usual chatter during the login # sequence. If a full pathname, then hushed mode will be enabled if the # user's name or shell are found in the file. If not a full pathname, then # hushed mode will be enabled if the file exists in the user's home directory. # #HUSHLOGIN_FILE .hushlogin #HUSHLOGIN_FILE /etc/hushlogins # Currently ENV_TZ is not supported # Currently ENV_HZ is not supported # # The default PATH settings, for superuser and normal users. # # (they are minimal, add the rest in the shell startup files) #ENV_SUPATH PATH=/sbin:/bin:/usr/sbin:/usr/bin #ENV_PATH PATH=/bin:/usr/bin # # Terminal permissions # # TTYGROUP Login tty will be assigned this group ownership. # TTYPERM Login tty will be set to this permission. # # If you have a write(1) program which is "setgid" to a special group # which owns the terminals, define TTYGROUP as the number of such group # and TTYPERM as 0620. Otherwise leave TTYGROUP commented out and # set TTYPERM to either 622 or 600. # #TTYGROUP tty #TTYPERM 0600 # Currently ERASECHAR, KILLCHAR and ULIMIT are not supported # Default initial "umask" value used by login(1) on non-PAM enabled systems. # Default "umask" value for pam_umask(8) on PAM enabled systems. # UMASK is also used by useradd(8) and newusers(8) to set the mode for new # home directories if HOME_MODE is not set. # 022 is the default value, but 027, or even 077, could be considered # for increased privacy. There is no One True Answer here: each sysadmin # must make up their mind. UMASK 022 # HOME_MODE is used by useradd(8) and newusers(8) to set the mode for new # home directories. # If HOME_MODE is not set, the value of UMASK is used to create the mode. HOME_MODE 0700 # Password aging controls: # # PASS_MAX_DAYS Maximum number of days a password may be used. # PASS_MIN_DAYS Minimum number of days allowed between password changes. # PASS_MIN_LEN Minimum acceptable password length. # PASS_WARN_AGE Number of days warning given before a password expires. # PASS_MAX_DAYS 99999 PASS_MIN_DAYS 0 PASS_WARN_AGE 7 # Currently PASS_MIN_LEN is not supported # Currently SU_WHEEL_ONLY is not supported # Currently CRACKLIB_DICTPATH is not supported # # Min/max values for automatic uid selection in useradd(8) # UID_MIN 1000 UID_MAX 60000 # System accounts SYS_UID_MIN 201 SYS_UID_MAX 999 |
<0, SYS_UID_MIN> system UIDs having shell set oval:ssg-test_shell_defined_reserved_uid_range:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /etc/passwd | inx:x:1000:1000:inx:/home/inx:/bin/bash |
<SYS_UID_MIN, SYS_UID_MAX> system UIDS having shell set oval:ssg-test_shell_defined_dynalloc_uid_range:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /etc/passwd | inx:x:1000:1000:inx:/home/inx:/bin/bash |
Enforce usage of pam_wheel for su authentication
| Rule ID | xccdf_org.ssgproject.content_rule_use_pam_wheel_for_su |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-use_pam_wheel_for_su:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-90085-2 References: FMT_SMF_EXT.1.1, Req-8.6.1, SRG-OS-000373-GPOS-00156, SRG-OS-000312-GPOS-00123, 5.3.7 |
| Description | To ensure that only users who are members of the wheel group can
run commands with altered privileges through the su command, make
sure that the following line exists in the file /etc/pam.d/su:
auth required pam_wheel.so use_uid |
| Rationale | The su program allows to run commands with a substitute user and
group ID. It is commonly used to run commands as the root user. Limiting
access to such command is considered a good security practice. |
| Warnings | warning
Members of "wheel" or GID 0 groups are checked by default if the group option is not set
for pam_wheel.so module. Therefore, members of these groups should be manually checked or
a different group should be informed according to the site policy. |
check /etc/pam.d/su for correct setting oval:ssg-test_use_pam_wheel_for_su:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_use_pam_wheel_for_su:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/pam.d/su | ^[\s]*auth[\s]+required[\s]+pam_wheel\.so[\s]+use_uid$ | 1 |
Ensure All Accounts on the System Have Unique User IDs
| Rule ID | xccdf_org.ssgproject.content_rule_account_unique_id |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-account_unique_id:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-88493-2 References: CCI-000135, CCI-000764, CCI-000804, SRG-OS-000104-GPOS-00051, SRG-OS-000121-GPOS-00062, SRG-OS-000042-GPOS-00020, 6.2.4 |
| Description | Change user IDs (UIDs), or delete accounts, so each has a unique name. |
| Rationale | To assure accountability and prevent unauthenticated access, interactive users must be identified and authenticated to prevent potential misuse and compromise of the system. |
| Warnings | warning
Automatic remediation of this control is not available due to unique requirements of each
system. |
There should not exist duplicate user ids in /etc/passwd oval:ssg-test_etc_passwd_no_duplicate_user_ids:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-variable_count_of_all_uids:var:1 | 37 |
Ensure All Groups on the System Have Unique Group ID
| Rule ID | xccdf_org.ssgproject.content_rule_group_unique_id |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-group_unique_id:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-86043-7 References: CCI-000764, SRG-OS-000104-GPOS-00051, 6.2.5 |
| Description | Change the group name or delete groups, so each has a unique id. |
| Rationale | To assure accountability and prevent unauthenticated access, groups must be identified uniquely to prevent potential misuse and compromise of the system. |
| Warnings | warning
Automatic remediation of this control is not available due to the unique requirements of each system. |
There should not exist duplicate group ids in /etc/passwd oval:ssg-test_etc_group_no_duplicate_group_ids:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-variable_count_of_all_group_ids:var:1 | 59 |
Ensure that Root's Path Does Not Include World or Group-Writable Directories
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_root_path_dirs_no_write |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_root_path_dirs_no_write:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83643-7 References: 11, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, CCI-000366, 4.3.4.3.2, 4.3.4.3.3, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, CM-6(a), CM-6(a), PR.IP-1, 6.2.8 |
| Description | For each element in root's path, run:
# ls -ld DIRand ensure that write permissions are disabled for group and other. |
| Rationale | Such entries increase the risk that root could
execute code provided by unprivileged users,
and potentially malicious code. |
Check if there aren't directories in root's path having write permission set for group or other oval:ssg-test_accounts_root_path_dirs_no_group_other_write:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_root_path_dirs_no_group_other_write:obj:1 of type file_object
| Path | Filename | Filter | Filter | ||||||
|---|---|---|---|---|---|---|---|---|---|
| no value | oval:ssg-state_accounts_root_path_dirs_wrong_perms:ste:1 | oval:ssg-state_accounts_root_path_dirs_symlink:ste:1 |
Ensure that Root's Path Does Not Include Relative Paths or Null Directories
| Rule ID | xccdf_org.ssgproject.content_rule_root_path_no_dot |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-root_path_no_dot:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | unknown |
| Identifiers and References | Identifiers: CCE-88059-1 References: 11, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, CCI-000366, 4.3.4.3.2, 4.3.4.3.3, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, CM-6(a), CM-6(a), PR.IP-1, 6.2.8 |
| Description | Ensure that none of the directories in root's path is equal to a single
. character, or
that it contains any instances that lead to relative path traversal, such as
.. or beginning a path without the slash (/) character.
Also ensure that there are no "empty" elements in the path, such as in these examples:
PATH=:/bin PATH=/bin: PATH=/bin::/sbinThese empty elements have the same effect as a single . character. |
| Rationale | Including these entries increases the risk that root could
execute code from an untrusted location. |
environment variable PATH starts with : or . oval:ssg-test_env_var_begins:tst:1 true
Following items have been found on the system:
| Pid | Name | Value |
|---|---|---|
| 7331 | PATH | /home/inx/.local/bin:/home/inx/bin:/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin |
environment variable PATH doesn't contain : twice in a row oval:ssg-test_env_var_contains_doublecolon:tst:1 true
Following items have been found on the system:
| Pid | Name | Value |
|---|---|---|
| 7331 | PATH | /home/inx/.local/bin:/home/inx/bin:/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin |
environment variable PATH doesn't contain . twice in a row oval:ssg-test_env_var_contains_doubleperiod:tst:1 true
Following items have been found on the system:
| Pid | Name | Value |
|---|---|---|
| 7331 | PATH | /home/inx/.local/bin:/home/inx/bin:/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin |
environment variable PATH ends with : or . oval:ssg-test_env_var_ends:tst:1 true
Following items have been found on the system:
| Pid | Name | Value |
|---|---|---|
| 7331 | PATH | /home/inx/.local/bin:/home/inx/bin:/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin |
environment variable PATH starts with an absolute path / oval:ssg-test_env_var_begins_slash:tst:1 true
Following items have been found on the system:
| Pid | Name | Value |
|---|---|---|
| 7331 | PATH | /home/inx/.local/bin:/home/inx/bin:/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin |
environment variable PATH contains relative paths oval:ssg-test_env_var_contains_relative_path:tst:1 true
Following items have been found on the system:
| Pid | Name | Value |
|---|---|---|
| 7331 | PATH | /home/inx/.local/bin:/home/inx/bin:/usr/local/bin:/usr/bin:/usr/local/sbin:/usr/sbin |
Ensure the Default Bash Umask is Set Correctly
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_umask_etc_bashrc |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_umask_etc_bashrc:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83644-5 References: BP28(R35), 18, APO13.01, BAI03.01, BAI03.02, BAI03.03, CCI-000366, 4.3.4.3.3, A.14.1.1, A.14.2.1, A.14.2.5, A.6.1.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, AC-6(1), CM-6(a), PR.IP-2, Req-8.6.1, SRG-OS-000480-GPOS-00228, SRG-OS-000480-GPOS-00227, 5.6.5 |
| Description | To ensure the default umask for users of the Bash shell is set properly,
add or correct the umask setting in /etc/bashrc to read
as follows:
umask 027 |
| Rationale | The umask value influences the permissions assigned to files when they are created.
A misconfigured umask value could result in files with excessive permissions that can be read or
written to by unauthorized users. |
Verify the existence of var_accounts_user_umask_as_number variable oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-var_accounts_user_umask_umask_as_number:var:1 | 23 |
Test the retrieved /etc/bashrc umask value(s) match the var_accounts_user_umask requirement oval:ssg-tst_accounts_umask_etc_bashrc:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_accounts_umask_etc_bashrc:obj:1 of type variable_object
| Var ref |
|---|
| oval:ssg-var_etc_bashrc_umask_as_number:var:1 |
Ensure the Default Umask is Set Correctly in login.defs
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_umask_etc_login_defs |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_umask_etc_login_defs:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83647-8 References: BP28(R35), 11, 18, 3, 9, APO13.01, BAI03.01, BAI03.02, BAI03.03, BAI10.01, BAI10.02, BAI10.03, BAI10.05, CCI-000366, 4.3.4.3.2, 4.3.4.3.3, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.1.1, A.14.2.1, A.14.2.2, A.14.2.3, A.14.2.4, A.14.2.5, A.6.1.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, AC-6(1), CM-6(a), PR.IP-1, PR.IP-2, Req-8.6.1, SRG-OS-000480-GPOS-00228, 5.6.5 |
| Description | To ensure the default umask controlled by /etc/login.defs is set properly,
add or correct the UMASK setting in /etc/login.defs to read as follows:
UMASK 027 |
| Rationale | The umask value influences the permissions assigned to files when they are created.
A misconfigured umask value could result in files with excessive permissions that can be read and
written to by unauthorized users. |
Verify the existence of var_accounts_user_umask_as_number variable oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-var_accounts_user_umask_umask_as_number:var:1 | 23 |
Test the retrieved /etc/login.defs umask value(s) match the var_accounts_user_umask requirement oval:ssg-tst_accounts_umask_etc_login_defs:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-var_etc_login_defs_umask_as_number:var:1 | 18 |
Ensure the Default Umask is Set Correctly in /etc/profile
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_umask_etc_profile |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_umask_etc_profile:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-90828-5 References: BP28(R35), 18, APO13.01, BAI03.01, BAI03.02, BAI03.03, CCI-000366, 4.3.4.3.3, A.14.1.1, A.14.2.1, A.14.2.5, A.6.1.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, AC-6(1), CM-6(a), PR.IP-2, Req-8.6.1, SRG-OS-000480-GPOS-00228, SRG-OS-000480-GPOS-00227, 5.6.5 |
| Description | To ensure the default umask controlled by /etc/profile is set properly,
add or correct the umask setting in /etc/profile to read as follows:
umask 027 |
| Rationale | The umask value influences the permissions assigned to files when they are created.
A misconfigured umask value could result in files with excessive permissions that can be read or
written to by unauthorized users. |
Verify the existence of var_accounts_user_umask_as_number variable oval:ssg-test_existence_of_var_accounts_user_umask_as_number_variable:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-var_accounts_user_umask_umask_as_number:var:1 | 23 |
Test the retrieved /etc/profile umask value(s) match the var_accounts_user_umask requirement oval:ssg-tst_accounts_umask_etc_profile:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_accounts_umask_etc_profile:obj:1 of type variable_object
| Var ref |
|---|
| oval:ssg-var_etc_profile_umask_as_number:var:1 |
Set Interactive Session Timeout
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_tmout |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_tmout:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83633-8 References: BP28(R29), 1, 12, 15, 16, DSS05.04, DSS05.10, DSS06.10, 3.1.11, CCI-000057, CCI-001133, CCI-002361, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, SR 1.1, SR 1.10, SR 1.2, SR 1.5, SR 1.7, SR 1.8, SR 1.9, A.18.1.4, A.9.2.1, A.9.2.4, A.9.3.1, A.9.4.2, A.9.4.3, CIP-004-6 R2.2.3, CIP-007-3 R5.1, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, AC-12, SC-10, AC-2(5), CM-6(a), PR.AC-7, FMT_MOF_EXT.1, Req-8.6.1, SRG-OS-000163-GPOS-00072, SRG-OS-000029-GPOS-00010, SRG-OS-000163-VMM-000700, SRG-OS-000279-VMM-001010, 5.6.3 |
| Description | Setting the TMOUT option in /etc/profile ensures that
all user sessions will terminate based on inactivity.
The value of TMOUT should be exported and read only.
The TMOUT
setting in a file loaded by /etc/profile, e.g.
/etc/profile.d/tmout.sh should read as follows:
declare -xr TMOUT=900 |
| Rationale | Terminating an idle session within a short time period reduces
the window of opportunity for unauthorized personnel to take control of a
management session enabled on the console or console port that has been
left unattended. |
TMOUT in /etc/profile oval:ssg-test_etc_profile_tmout:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_etc_profile_tmout:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/profile | ^[\s]*declare[\s]+-xr[\s]+TMOUT=([\w$]+).*$ | 1 |
TMOUT in /etc/profile.d/*.sh oval:ssg-test_etc_profiled_tmout:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_etc_profiled_tmout:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/profile.d | ^.*\.sh$ | ^[\s]*declare[\s]+-xr[\s]+TMOUT=([\w$]+).*$ | 1 |
Check that at least one TMOUT is defined oval:ssg-test_accounts_tmout_defined:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_tmout_defined:obj:1 of type variable_object
| Var ref |
|---|
| oval:ssg-variable_count_of_tmout_instances:var:1 |
User Initialization Files Must Not Run World-Writable Programs
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_user_dot_no_world_writable_programs |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_user_dot_no_world_writable_programs:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-87451-1 References: CCI-000366, SRG-OS-000480-GPOS-00227, 6.2.16 |
| Description | Set the mode on files being executed by the user initialization files with the
following command:
$ sudo chmod o-w FILE |
| Rationale | If user start-up files execute world-writable programs, especially in
unprotected directories, they could be maliciously modified to destroy user
files or otherwise compromise the system at the user level. If the system is
compromised at the user level, it is easier to elevate privileges to eventually
compromise the system at the root and network level. |
Init files do not execute world-writable programs oval:ssg-test_accounts_user_dot_no_world_writable_programs:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_accounts_user_dot_no_world_writable_programs_init_files:obj:1 of type textfilecontent54_object
| Behaviors | Path | Filename | Pattern | Instance |
|---|---|---|---|---|
| no value | 1 |
All Interactive Users Home Directories Must Exist
| Rule ID | xccdf_org.ssgproject.content_rule_accounts_user_interactive_home_directory_exists |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-accounts_user_interactive_home_directory_exists:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83639-5 References: CCI-000366, SRG-OS-000480-GPOS-00227, 6.2.10 |
| Description | Create home directories to all interactive users that currently do not
have a home directory assigned. Use the following commands to create the user
home directory assigned in /etc/passwd:
$ sudo mkdir /home/USER |
| Rationale | If a local interactive user has a home directory defined that does not exist,
the user may be given access to the / directory as the current working directory
upon logon. This could create a Denial of Service because the user would not be
able to access their logon configuration files, and it may give them visibility
to system files they normally would not be able to access. |
Check the existence of interactive users. oval:ssg-test_accounts_user_interactive_home_directory_exists:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-var_accounts_user_interactive_home_directory_exists_dirs_count_fs:var:1 | 1 |
Check the existence of interactive users. oval:ssg-test_accounts_user_interactive_home_directory_exists_users:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-var_accounts_user_interactive_home_directory_exists_dirs_count:var:1 | 1 |
All Interactive User Home Directories Must Be Group-Owned By The Primary User
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupownership_home_directories |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupownership_home_directories:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83629-6 References: CCI-000366, SRG-OS-000480-GPOS-00227, 6.2.11 |
| Description | Change the group owner of interactive users home directory to the
group found in /etc/passwd. To change the group owner of
interactive users home directory, use the following command:
$ sudo chgrp USER_GROUP /home/USERThis rule ensures every home directory related to an interactive user is group-owned by an interactive user. It also ensures that interactive users are group-owners of one and only one home directory. |
| Rationale | If the Group Identifier (GID) of a local interactive users home directory is
not the same as the primary GID of the user, this would allow unauthorized
access to the users files, and users that share the same group may not be
able to access files that they legitimately should. |
| Warnings | warning
Due to OVAL limitation, this rule can report a false negative in a
specific situation where two interactive users swap the group-ownership
of their respective home directories. |
All home directories are group-owned by a local interactive group oval:ssg-test_file_groupownership_home_directories:tst:1 true
Following items have been found on the system:
| Path | Type | UID | GID | Size (B) | Permissions |
|---|---|---|---|---|---|
| /home/inx/ | directory | 1000 | 1000 | 4096 | rwx------ |
Enable authselect
| Rule ID | xccdf_org.ssgproject.content_rule_enable_authselect |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-enable_authselect:def:1 |
| Time | 2023-07-10T14:09:58+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-89732-2 References: BP28(R5), CCI-000213, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), AC-3, FIA_UAU.1, FIA_AFL.1, SRG-OS-000480-GPOS-00227, 5.4.1 |
| Description | Configure user authentication setup to use the authselect tool.
If authselect profile is selected, the rule will enable the sssd profile. |
| Rationale | Authselect is a successor to authconfig.
It is a tool to select system authentication and identity sources from a list of supported
profiles instead of letting the administrator manually build the PAM stack.
That way, it avoids potential breakage of configuration, as it ships several tested profiles
that are well tested and supported to solve different use-cases. |
| Warnings | warning
If the sudo authselect select command returns an error informing that the chosen
profile cannot be selected, it is probably because PAM files have already been modified by
the administrator. If this is the case, in order to not overwrite the desired changes made
by the administrator, the current PAM settings should be investigated before forcing the
selection of the chosen authselect profile. |
The 'fingerprint-auth' PAM config is a symlink to its authselect counterpart oval:ssg-test_pam_fingerprint_symlinked_to_authselect:tst:1 true
Following items have been found on the system:
| Filepath | Canonical path |
|---|---|
| /etc/pam.d/fingerprint-auth | /etc/authselect/fingerprint-auth |
The 'password-auth' PAM config is a symlink to its authselect counterpart oval:ssg-test_pam_password_symlinked_to_authselect:tst:1 true
Following items have been found on the system:
| Filepath | Canonical path |
|---|---|
| /etc/pam.d/password-auth | /etc/authselect/password-auth |
The 'postlogin' PAM config is a symlink to its authselect counterpart oval:ssg-test_pam_postlogin_symlinked_to_authselect:tst:1 true
Following items have been found on the system:
| Filepath | Canonical path |
|---|---|
| /etc/pam.d/postlogin | /etc/authselect/postlogin |
The 'smartcard-auth' PAM config is a symlink to its authselect counterpart oval:ssg-test_pam_smartcard_symlinked_to_authselect:tst:1 true
Following items have been found on the system:
| Filepath | Canonical path |
|---|---|
| /etc/pam.d/smartcard-auth | /etc/authselect/smartcard-auth |
The 'system-auth' PAM config is a symlink to its authselect counterpart oval:ssg-test_pam_system_symlinked_to_authselect:tst:1 true
Following items have been found on the system:
| Filepath | Canonical path |
|---|---|
| /etc/pam.d/system-auth | /etc/authselect/system-auth |
Record Events that Modify the System's Discretionary Access Controls - chmod
| Rule ID | xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chmod |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-audit_rules_dac_modification_chmod:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83830-0 References: 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-000126, CCI-000130, CCI-000135, CCI-000169, CCI-000172, CCI-002884, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1.1.c, Req-10.5.5, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000064-GPOS-00033, SRG-OS-000466-GPOS-00210, SRG-OS-000458-GPOS-00203, SRG-OS-000458-VMM-001810, SRG-OS-000474-VMM-001940, 4.1.3.9 |
| Description | At a minimum, the audit system should collect file permission
changes for all users and root. If the auditd daemon is configured to
use the augenrules program to read audit rules during daemon startup
(the default), add the following line to a file with suffix .rules in
the directory /etc/audit/rules.d:
-a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_modIf the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_modIf the auditd daemon is configured to use the auditctl
utility to read audit rules during daemon startup, add the following line to
/etc/audit/audit.rules file:
-a always,exit -F arch=b32 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_modIf the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S chmod -F auid>=1000 -F auid!=unset -F key=perm_mod |
| Rationale | The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users. |
| Warnings | warning
Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient. |
audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /usr/lib/systemd/system/auditd.service | ExecStartPost=-/sbin/augenrules --load |
audit augenrules 32-bit chmod oval:ssg-test_32bit_ardm_chmod_augenrules:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_32bit_ardm_chmod_augenrules:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/audit/rules\.d/.*\.rules$ | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
audit augenrules 64-bit chmod oval:ssg-test_64bit_ardm_chmod_augenrules:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_64bit_ardm_chmod_augenrules:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/audit/rules\.d/.*\.rules$ | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /usr/lib/systemd/system/auditd.service | ^ExecStartPost=\-\/sbin\/auditctl.*$ | 1 |
audit auditctl 32-bit chmod oval:ssg-test_32bit_ardm_chmod_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_32bit_ardm_chmod_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/audit.rules | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
audit auditctl 64-bit chmod oval:ssg-test_64bit_ardm_chmod_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_64bit_ardm_chmod_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/audit.rules | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chmod[\s]+|([\s]+|[,])chmod([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
Record Events that Modify the System's Discretionary Access Controls - chown
| Rule ID | xccdf_org.ssgproject.content_rule_audit_rules_dac_modification_chown |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-audit_rules_dac_modification_chown:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83812-8 References: 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-000126, CCI-000130, CCI-000135, CCI-000169, CCI-000172, CCI-002884, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1.1.c, Req-10.5.5, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000064-GPOS-00033, SRG-OS-000466-GPOS-00210, SRG-OS-000458-GPOS-00203, SRG-OS-000474-GPOS-00219, SRG-OS-000458-VMM-001810, SRG-OS-000474-VMM-001940, 4.1.3.9 |
| Description | At a minimum, the audit system should collect file permission
changes for all users and root. If the auditd daemon is configured to
use the augenrules program to read audit rules during daemon startup
(the default), add the following line to a file with suffix .rules in
the directory /etc/audit/rules.d:
-a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=unset -F key=perm_modIf the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=unset -F key=perm_modIf the auditd daemon is configured to use the auditctl
utility to read audit rules during daemon startup, add the following line to
/etc/audit/audit.rules file:
-a always,exit -F arch=b32 -S chown -F auid>=1000 -F auid!=unset -F key=perm_modIf the system is 64 bit then also add the following line: -a always,exit -F arch=b64 -S chown -F auid>=1000 -F auid!=unset -F key=perm_mod |
| Rationale | The changing of file permissions could indicate that a user is attempting to
gain access to information that would otherwise be disallowed. Auditing DAC modifications
can facilitate the identification of patterns of abuse among both authorized and
unauthorized users. |
| Warnings | warning
Note that these rules can be configured in a
number of ways while still achieving the desired effect. Here the system calls
have been placed independent of other system calls. Grouping these system
calls with others as identifying earlier in this guide is more efficient. |
audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /usr/lib/systemd/system/auditd.service | ExecStartPost=-/sbin/augenrules --load |
audit augenrules 32-bit chown oval:ssg-test_32bit_ardm_chown_augenrules:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_32bit_ardm_chown_augenrules:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/audit/rules\.d/.*\.rules$ | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
audit augenrules 64-bit chown oval:ssg-test_64bit_ardm_chown_augenrules:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_64bit_ardm_chown_augenrules:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/audit/rules\.d/.*\.rules$ | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /usr/lib/systemd/system/auditd.service | ^ExecStartPost=\-\/sbin\/auditctl.*$ | 1 |
audit auditctl 32-bit chown oval:ssg-test_32bit_ardm_chown_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_32bit_ardm_chown_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/audit.rules | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
audit auditctl 64-bit chown oval:ssg-test_64bit_ardm_chown_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_64bit_ardm_chown_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/audit.rules | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+chown[\s]+|([\s]+|[,])chown([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
Record Any Attempts to Run chacl
| Rule ID | xccdf_org.ssgproject.content_rule_audit_rules_execution_chacl |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-audit_rules_execution_chacl:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-87685-4 References: CCI-000130, CCI-000135, CCI-000169, CCI-000172, CCI-002884, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000466-GPOS-00210, 4.1.3.17 |
| Description | At a minimum, the audit system should collect any execution attempt
of the chacl command for all users and root. If the auditd
daemon is configured to use the augenrules program to read audit rules
during daemon startup (the default), add the following lines to a file with suffix
.rules in the directory /etc/audit/rules.d:
-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -F key=privilegedIf the auditd daemon is configured to use the auditctl
utility to read audit rules during daemon startup, add the following lines to
/etc/audit/audit.rules file:
-a always,exit -F path=/usr/bin/chacl -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged |
| Rationale | Without generating audit records that are specific to the security and
mission needs of the organization, it would be difficult to establish,
correlate, and investigate the events relating to an incident or identify
those responsible for one.
Audit records can be generated from various components within the
information system (e.g., module or policy filter). |
audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /usr/lib/systemd/system/auditd.service | ExecStartPost=-/sbin/augenrules --load |
audit augenrules chacl oval:ssg-test_audit_rules_execution_chacl_augenrules:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_execution_chacl_augenrules:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/audit/rules\.d/.*\.rules$ | ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chacl(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /usr/lib/systemd/system/auditd.service | ^ExecStartPost=\-\/sbin\/auditctl.*$ | 1 |
audit auditctl chacl oval:ssg-test_audit_rules_execution_chacl_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_execution_chacl_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/audit.rules | ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chacl(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
Record Any Attempts to Run setfacl
| Rule ID | xccdf_org.ssgproject.content_rule_audit_rules_execution_setfacl |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-audit_rules_execution_setfacl:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-90482-1 References: CCI-000130, CCI-000135, CCI-000169, CCI-000172, CCI-002884, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, 4.1.3.16 |
| Description | At a minimum, the audit system should collect any execution attempt
of the setfacl command for all users and root. If the auditd
daemon is configured to use the augenrules program to read audit rules
during daemon startup (the default), add the following lines to a file with suffix
.rules in the directory /etc/audit/rules.d:
-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -F key=privilegedIf the auditd daemon is configured to use the auditctl
utility to read audit rules during daemon startup, add the following lines to
/etc/audit/audit.rules file:
-a always,exit -F path=/usr/bin/setfacl -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged |
| Rationale | Without generating audit records that are specific to the security and
mission needs of the organization, it would be difficult to establish,
correlate, and investigate the events relating to an incident or identify
those responsible for one.
Audit records can be generated from various components within the
information system (e.g., module or policy filter). |
audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /usr/lib/systemd/system/auditd.service | ExecStartPost=-/sbin/augenrules --load |
audit augenrules setfacl oval:ssg-test_audit_rules_execution_setfacl_augenrules:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_execution_setfacl_augenrules:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/audit/rules\.d/.*\.rules$ | ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/setfacl(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /usr/lib/systemd/system/auditd.service | ^ExecStartPost=\-\/sbin\/auditctl.*$ | 1 |
audit auditctl setfacl oval:ssg-test_audit_rules_execution_setfacl_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_execution_setfacl_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/audit.rules | ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/setfacl(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
Record Any Attempts to Run chcon
| Rule ID | xccdf_org.ssgproject.content_rule_audit_rules_execution_chcon |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-audit_rules_execution_chcon:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83748-4 References: 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, BAI03.05, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-000130, CCI-000135, CCI-000169, CCI-000172, CCI-002884, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.PT-1, FAU_GEN.1.1.c, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000468-GPOS-00212, SRG-OS-000471-GPOS-00215, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000463-VMM-001850, 4.1.3.15 |
| Description | At a minimum, the audit system should collect any execution attempt
of the chcon command for all users and root. If the auditd
daemon is configured to use the augenrules program to read audit rules
during daemon startup (the default), add the following lines to a file with suffix
.rules in the directory /etc/audit/rules.d:
-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -F key=privilegedIf the auditd daemon is configured to use the auditctl
utility to read audit rules during daemon startup, add the following lines to
/etc/audit/audit.rules file:
-a always,exit -F path=/usr/bin/chcon -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged |
| Rationale | Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity. |
audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /usr/lib/systemd/system/auditd.service | ExecStartPost=-/sbin/augenrules --load |
audit augenrules chcon oval:ssg-test_audit_rules_execution_chcon_augenrules:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_execution_chcon_augenrules:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/audit/rules\.d/.*\.rules$ | ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chcon(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /usr/lib/systemd/system/auditd.service | ^ExecStartPost=\-\/sbin\/auditctl.*$ | 1 |
audit auditctl chcon oval:ssg-test_audit_rules_execution_chcon_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_execution_chcon_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/audit.rules | ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/chcon(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
Record Any Attempts to Run setsebool
| Rule ID | xccdf_org.ssgproject.content_rule_audit_rules_execution_setsebool |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-audit_rules_execution_setsebool:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83751-8 References: 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, BAI03.05, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-000130, CCI-000135, CCI-000169, CCI-000172, CCI-002884, 164.308(a)(1)(ii)(D), 164.308(a)(3)(ii)(A), 164.308(a)(5)(ii)(C), 164.312(a)(2)(i), 164.312(b), 164.312(d), 164.312(e), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, AU-2(d), AU-12(c), AC-6(9), CM-6(a), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.PT-1, FAU_GEN.1.1.c, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000463-GPOS-00207, SRG-OS-000465-GPOS-00209, SRG-OS-000463-VMM-001850 |
| Description | At a minimum, the audit system should collect any execution attempt
of the setsebool command for all users and root. If the auditd
daemon is configured to use the augenrules program to read audit rules
during daemon startup (the default), add the following lines to a file with suffix
.rules in the directory /etc/audit/rules.d:
-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -F key=privilegedIf the auditd daemon is configured to use the auditctl
utility to read audit rules during daemon startup, add the following lines to
/etc/audit/audit.rules file:
-a always,exit -F path=/usr/sbin/setsebool -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged |
| Rationale | Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity. |
audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /usr/lib/systemd/system/auditd.service | ExecStartPost=-/sbin/augenrules --load |
audit augenrules setsebool oval:ssg-test_audit_rules_execution_setsebool_augenrules:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_execution_setsebool_augenrules:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/audit/rules\.d/.*\.rules$ | ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/setsebool(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /usr/lib/systemd/system/auditd.service | ^ExecStartPost=\-\/sbin\/auditctl.*$ | 1 |
audit auditctl setsebool oval:ssg-test_audit_rules_execution_setsebool_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_execution_setsebool_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/audit.rules | ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/setsebool(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
Ensure auditd Collects File Deletion Events by User
| Rule ID | xccdf_org.ssgproject.content_rule_audit_rules_file_deletion_events |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-audit_rules_file_deletion_events:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83752-6 References: 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 9, 5.4.1.1, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO12.06, APO13.01, BAI03.05, BAI08.02, DSS01.03, DSS01.04, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS03.05, DSS05.02, DSS05.03, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, 3.1.7, CCI-000366, CCI-000172, CCI-002884, 4.2.3.10, 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.6.6, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.13, SR 2.10, SR 2.11, SR 2.12, SR 2.6, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.1, SR 6.2, SR 7.1, SR 7.6, A.11.2.6, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.7, A.15.2.1, A.15.2.2, A.16.1.4, A.16.1.5, A.16.1.7, A.6.2.1, A.6.2.2, AU-2(d), AU-12(c), CM-6(a), DE.AE-3, DE.AE-5, DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.AC-3, PR.PT-1, PR.PT-4, RS.AN-1, RS.AN-4, FAU_GEN.1.1.c, Req-10.2.7 |
| Description | At a minimum the audit system should collect file deletion events
for all users and root. If the auditd daemon is configured to use the
augenrules program to read audit rules during daemon startup (the
default), add the following line to a file with suffix .rules in the
directory /etc/audit/rules.d, setting ARCH to either b32 or b64 as
appropriate for your system:
-a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename,renameat -F auid>=1000 -F auid!=unset -F key=deleteIf the auditd daemon is configured to use the auditctl
utility to read audit rules during daemon startup, add the following line to
/etc/audit/audit.rules file, setting ARCH to either b32 or b64 as
appropriate for your system:
-a always,exit -F arch=ARCH -S rmdir,unlink,unlinkat,rename -S renameat -F auid>=1000 -F auid!=unset -F key=delete |
| Rationale | Auditing file deletions will create an audit trail for files that are removed
from the system. The audit trail could aid in system troubleshooting, as well as, detecting
malicious processes that attempt to delete log files to conceal their presence. |
| Warnings | warning
This rule checks for multiple syscalls related to file deletion;
it was written with DISA STIG in mind. Other policies should use a
separate rule for each syscall that needs to be checked. For example:
|
audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /usr/lib/systemd/system/auditd.service | ExecStartPost=-/sbin/augenrules --load |
audit augenrules 32-bit rmdir oval:ssg-test_32bit_ardm_rmdir_augenrules:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_32bit_ardm_rmdir_augenrules:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/audit/rules\.d/.*\.rules$ | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
audit augenrules 64-bit rmdir oval:ssg-test_64bit_ardm_rmdir_augenrules:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_64bit_ardm_rmdir_augenrules:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/audit/rules\.d/.*\.rules$ | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /usr/lib/systemd/system/auditd.service | ^ExecStartPost=\-\/sbin\/auditctl.*$ | 1 |
audit auditctl 32-bit rmdir oval:ssg-test_32bit_ardm_rmdir_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_32bit_ardm_rmdir_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/audit.rules | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
audit auditctl 64-bit rmdir oval:ssg-test_64bit_ardm_rmdir_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_64bit_ardm_rmdir_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/audit.rules | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rmdir[\s]+|([\s]+|[,])rmdir([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /usr/lib/systemd/system/auditd.service | ExecStartPost=-/sbin/augenrules --load |
audit augenrules 32-bit unlink oval:ssg-test_32bit_ardm_unlink_augenrules:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_32bit_ardm_unlink_augenrules:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/audit/rules\.d/.*\.rules$ | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
audit augenrules 64-bit unlink oval:ssg-test_64bit_ardm_unlink_augenrules:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_64bit_ardm_unlink_augenrules:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/audit/rules\.d/.*\.rules$ | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /usr/lib/systemd/system/auditd.service | ^ExecStartPost=\-\/sbin\/auditctl.*$ | 1 |
audit auditctl 32-bit unlink oval:ssg-test_32bit_ardm_unlink_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_32bit_ardm_unlink_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/audit.rules | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
audit auditctl 64-bit unlink oval:ssg-test_64bit_ardm_unlink_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_64bit_ardm_unlink_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/audit.rules | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlink[\s]+|([\s]+|[,])unlink([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /usr/lib/systemd/system/auditd.service | ExecStartPost=-/sbin/augenrules --load |
audit augenrules 32-bit unlinkat oval:ssg-test_32bit_ardm_unlinkat_augenrules:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_32bit_ardm_unlinkat_augenrules:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/audit/rules\.d/.*\.rules$ | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
audit augenrules 64-bit unlinkat oval:ssg-test_64bit_ardm_unlinkat_augenrules:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_64bit_ardm_unlinkat_augenrules:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/audit/rules\.d/.*\.rules$ | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /usr/lib/systemd/system/auditd.service | ^ExecStartPost=\-\/sbin\/auditctl.*$ | 1 |
audit auditctl 32-bit unlinkat oval:ssg-test_32bit_ardm_unlinkat_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_32bit_ardm_unlinkat_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/audit.rules | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
audit auditctl 64-bit unlinkat oval:ssg-test_64bit_ardm_unlinkat_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_64bit_ardm_unlinkat_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/audit.rules | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+unlinkat[\s]+|([\s]+|[,])unlinkat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /usr/lib/systemd/system/auditd.service | ExecStartPost=-/sbin/augenrules --load |
audit augenrules 32-bit rename oval:ssg-test_32bit_ardm_rename_augenrules:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_32bit_ardm_rename_augenrules:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/audit/rules\.d/.*\.rules$ | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
audit augenrules 64-bit rename oval:ssg-test_64bit_ardm_rename_augenrules:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_64bit_ardm_rename_augenrules:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/audit/rules\.d/.*\.rules$ | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /usr/lib/systemd/system/auditd.service | ^ExecStartPost=\-\/sbin\/auditctl.*$ | 1 |
audit auditctl 32-bit rename oval:ssg-test_32bit_ardm_rename_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_32bit_ardm_rename_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/audit.rules | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
audit auditctl 64-bit rename oval:ssg-test_64bit_ardm_rename_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_64bit_ardm_rename_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/audit.rules | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+rename[\s]+|([\s]+|[,])rename([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /usr/lib/systemd/system/auditd.service | ExecStartPost=-/sbin/augenrules --load |
audit augenrules 32-bit renameat oval:ssg-test_32bit_ardm_renameat_augenrules:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_32bit_ardm_renameat_augenrules:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/audit/rules\.d/.*\.rules$ | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
audit augenrules 64-bit renameat oval:ssg-test_64bit_ardm_renameat_augenrules:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_64bit_ardm_renameat_augenrules:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/audit/rules\.d/.*\.rules$ | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /usr/lib/systemd/system/auditd.service | ^ExecStartPost=\-\/sbin\/auditctl.*$ | 1 |
audit auditctl 32-bit renameat oval:ssg-test_32bit_ardm_renameat_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_32bit_ardm_renameat_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/audit.rules | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b32[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
64 bit architecture oval:ssg-test_system_info_architecture_x86_64:tst:1 true
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppc_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_ppcle_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_aarch_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
64 bit architecture oval:ssg-test_system_info_architecture_s390_64:tst:1 false
Following items have been found on the system:
| Machine class | Node name | Os name | Os release | Os version | Processor type |
|---|---|---|---|---|---|
| x86_64 | localhost.localdomain | Linux | 5.14.0-284.11.1.el9_2.x86_64 | #1 SMP PREEMPT_DYNAMIC Wed Apr 12 10:45:03 EDT 2023 | x86_64 |
audit auditctl 64-bit renameat oval:ssg-test_64bit_ardm_renameat_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_64bit_ardm_renameat_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/audit.rules | ^[\s]*-a[\s]+always,exit[\s]+(?:.*-F[\s]+arch=b64[\s]+)(?:.*(-S[\s]+renameat[\s]+|([\s]+|[,])renameat([\s]+|[,])))(?:.*-F\s+auid>=1000[\s]+)(?:.*-F\s+auid!=(?:4294967295|unset)[\s]+).*(-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
Ensure auditd Collects Information on the Use of Privileged Commands - init
| Rule ID | xccdf_org.ssgproject.content_rule_audit_privileged_commands_init |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-audit_privileged_commands_init:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-85956-1 References: CCI-000172, AU-12(c), SRG-OS-000477-GPOS-00222 |
| Description | At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the auditd daemon is
configured to use the augenrules program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix .rules in the directory /etc/audit/rules.d:
-a always,exit -F path=/usr/sbin/init -F auid>=1000 -F auid!=unset -F key=privilegedIf the auditd daemon is configured to use the auditctl
utility to read audit rules during daemon startup, add a line of the following
form to /etc/audit/audit.rules:
-a always,exit -F path=/usr/sbin/init -F auid>=1000 -F auid!=unset -F key=privileged |
| Rationale | Misuse of the init command may cause availability issues for the system. |
audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /usr/lib/systemd/system/auditd.service | ExecStartPost=-/sbin/augenrules --load |
audit augenrules init oval:ssg-test_audit_privileged_commands_init_augenrules:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_privileged_commands_init_augenrules:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/audit/rules\.d/.*\.rules$ | ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/init(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /usr/lib/systemd/system/auditd.service | ^ExecStartPost=\-\/sbin\/auditctl.*$ | 1 |
audit auditctl init oval:ssg-test_audit_privileged_commands_init_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_privileged_commands_init_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/audit.rules | ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/init(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
Ensure auditd Collects Information on the Use of Privileged Commands - poweroff
| Rule ID | xccdf_org.ssgproject.content_rule_audit_privileged_commands_poweroff |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-audit_privileged_commands_poweroff:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-85957-9 References: CCI-000172, AU-12(c), SRG-OS-000477-GPOS-00222 |
| Description | At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the auditd daemon is
configured to use the augenrules program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix .rules in the directory /etc/audit/rules.d:
-a always,exit -F path=/usr/sbin/poweroff -F auid>=1000 -F auid!=unset -F key=privilegedIf the auditd daemon is configured to use the auditctl
utility to read audit rules during daemon startup, add a line of the following
form to /etc/audit/audit.rules:
-a always,exit -F path=/usr/sbin/poweroff -F auid>=1000 -F auid!=unset -F key=privileged |
| Rationale | Misuse of the poweroff command may cause availability issues for the system. |
audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /usr/lib/systemd/system/auditd.service | ExecStartPost=-/sbin/augenrules --load |
audit augenrules poweroff oval:ssg-test_audit_privileged_commands_poweroff_augenrules:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_privileged_commands_poweroff_augenrules:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/audit/rules\.d/.*\.rules$ | ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/poweroff(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /usr/lib/systemd/system/auditd.service | ^ExecStartPost=\-\/sbin\/auditctl.*$ | 1 |
audit auditctl poweroff oval:ssg-test_audit_privileged_commands_poweroff_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_privileged_commands_poweroff_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/audit.rules | ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/poweroff(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
Ensure auditd Collects Information on the Use of Privileged Commands - reboot
| Rule ID | xccdf_org.ssgproject.content_rule_audit_privileged_commands_reboot |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-audit_privileged_commands_reboot:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-85958-7 References: CCI-000172, AU-12(c), SRG-OS-000477-GPOS-00222 |
| Description | At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the auditd daemon is
configured to use the augenrules program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix .rules in the directory /etc/audit/rules.d:
-a always,exit -F path=/usr/sbin/reboot -F auid>=1000 -F auid!=unset -F key=privilegedIf the auditd daemon is configured to use the auditctl
utility to read audit rules during daemon startup, add a line of the following
form to /etc/audit/audit.rules:
-a always,exit -F path=/usr/sbin/reboot -F auid>=1000 -F auid!=unset -F key=privileged |
| Rationale | Misuse of the reboot command may cause availability issues for the system. |
audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /usr/lib/systemd/system/auditd.service | ExecStartPost=-/sbin/augenrules --load |
audit augenrules reboot oval:ssg-test_audit_privileged_commands_reboot_augenrules:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_privileged_commands_reboot_augenrules:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/audit/rules\.d/.*\.rules$ | ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/reboot(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /usr/lib/systemd/system/auditd.service | ^ExecStartPost=\-\/sbin\/auditctl.*$ | 1 |
audit auditctl reboot oval:ssg-test_audit_privileged_commands_reboot_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_privileged_commands_reboot_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/audit.rules | ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/reboot(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
Ensure auditd Collects Information on the Use of Privileged Commands - shutdown
| Rule ID | xccdf_org.ssgproject.content_rule_audit_privileged_commands_shutdown |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-audit_privileged_commands_shutdown:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-85959-5 References: CCI-000172, AU-12(c), SRG-OS-000477-GPOS-00222 |
| Description | At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the auditd daemon is
configured to use the augenrules program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix .rules in the directory /etc/audit/rules.d:
-a always,exit -F path=/usr/sbin/shutdown -F auid>=1000 -F auid!=unset -F key=privilegedIf the auditd daemon is configured to use the auditctl
utility to read audit rules during daemon startup, add a line of the following
form to /etc/audit/audit.rules:
-a always,exit -F path=/usr/sbin/shutdown -F auid>=1000 -F auid!=unset -F key=privileged |
| Rationale | Misuse of the shutdown command may cause availability issues for the system. |
audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /usr/lib/systemd/system/auditd.service | ExecStartPost=-/sbin/augenrules --load |
audit augenrules shutdown oval:ssg-test_audit_privileged_commands_shutdown_augenrules:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_privileged_commands_shutdown_augenrules:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/audit/rules\.d/.*\.rules$ | ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/shutdown(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /usr/lib/systemd/system/auditd.service | ^ExecStartPost=\-\/sbin\/auditctl.*$ | 1 |
audit auditctl shutdown oval:ssg-test_audit_privileged_commands_shutdown_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_privileged_commands_shutdown_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/audit.rules | ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/sbin\/shutdown(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
Ensure auditd Collects Information on the Use of Privileged Commands - mount
| Rule ID | xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_mount |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-audit_rules_privileged_commands_mount:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-89564-9 References: CCI-000130, CCI-000135, CCI-000169, CCI-000172, CCI-002884, AU-2(d), AU-12(c), AC-6(9), CM-6(a), FAU_GEN.1.1.c, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000471-GPOS-00215, SRG-OS-000471-VMM-001910 |
| Description | At a minimum, the audit system should collect the execution of
privileged commands for all users and root. If the auditd daemon is
configured to use the augenrules program to read audit rules during
daemon startup (the default), add a line of the following form to a file with
suffix .rules in the directory /etc/audit/rules.d:
-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=privilegedIf the auditd daemon is configured to use the auditctl
utility to read audit rules during daemon startup, add a line of the following
form to /etc/audit/audit.rules:
-a always,exit -F path=/usr/bin/mount -F perm=x -F auid>=1000 -F auid!=unset -F key=privileged |
| Rationale | Misuse of privileged functions, either intentionally or unintentionally by
authorized users, or by unauthorized external entities that have compromised system accounts,
is a serious and ongoing concern and can have significant adverse impacts on organizations.
Auditing the use of privileged functions is one way to detect such misuse and identify
the risk from insider and advanced persistent threats.
Privileged programs are subject to escalation-of-privilege attacks, which attempt to subvert their normal role of providing some necessary but limited capability. As such, motivation exists to monitor these programs for unusual activity. |
audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /usr/lib/systemd/system/auditd.service | ExecStartPost=-/sbin/augenrules --load |
audit augenrules mount oval:ssg-test_audit_rules_privileged_commands_mount_augenrules:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_privileged_commands_mount_augenrules:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/audit/rules\.d/.*\.rules$ | ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/mount(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /usr/lib/systemd/system/auditd.service | ^ExecStartPost=\-\/sbin\/auditctl.*$ | 1 |
audit auditctl mount oval:ssg-test_audit_rules_privileged_commands_mount_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_privileged_commands_mount_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/audit.rules | ^[\s]*-a[\s]+always,exit[\s]+-F[\s]+path=\/usr\/bin\/mount(?:[\s]+-F[\s]+perm=x)[\s]+-F[\s]+auid>=1000[\s]+-F[\s]+auid!=(?:4294967295|unset|-1)[\s]+(?:-k[\s]+|-F[\s]+key=)[\S]+[\s]*$ | 1 |
Ensure auditd Collects System Administrator Actions - /etc/sudoers
| Rule ID | xccdf_org.ssgproject.content_rule_audit_rules_sudoers |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-audit_rules_sudoers:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-90176-9 References: CCI-000018, CCI-000130, CCI-000135, CCI-000169, CCI-000172, CCI-001403, CCI-001404, CCI-002130, CCI-002132, CCI-002884, SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221 |
| Description | At a minimum, the audit system should collect administrator actions
for all users and root. If the auditd daemon is configured to use the
augenrules program to read audit rules during daemon startup (the default),
add the following line to a file with suffix .rules in the directory
/etc/audit/rules.d:
-w /etc/sudoers -p wa -k actionsIf the auditd daemon is configured to use the auditctl
utility to read audit rules during daemon startup, add the following line to
/etc/audit/audit.rules file:
-w /etc/sudoers -p wa -k actions |
| Rationale | The actions taken by system administrators should be audited to keep a record
of what was executed on the system, as well as, for accountability purposes.
Editing the sudoers file may be sign of an attacker trying to
establish persistent methods to a system, auditing the editing of the sudoers
files mitigates this risk. |
audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /usr/lib/systemd/system/auditd.service | ExecStartPost=-/sbin/augenrules --load |
audit augenrules sudoers oval:ssg-test_audit_rules_sudoers_augenrules:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_sudoers_augenrules:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/audit/rules\.d/.*\.rules$ | ^\-w[\s]+/etc/sudoers[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$ | 1 |
audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /usr/lib/systemd/system/auditd.service | ^ExecStartPost=\-\/sbin\/auditctl.*$ | 1 |
audit auditctl sudoers oval:ssg-test_audit_rules_sudoers_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_sudoers_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/audit.rules | ^\-w[\s]+/etc/sudoers[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$ | 1 |
Ensure auditd Collects System Administrator Actions - /etc/sudoers.d/
| Rule ID | xccdf_org.ssgproject.content_rule_audit_rules_sudoers_d |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-audit_rules_sudoers_d:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-89498-0 References: CCI-000018, CCI-000130, CCI-000135, CCI-000169, CCI-000172, CCI-001403, CCI-001404, CCI-002130, CCI-002132, CCI-002884, SRG-OS-000004-GPOS-00004, SRG-OS-000037-GPOS-00015, SRG-OS-000042-GPOS-00020, SRG-OS-000062-GPOS-00031, SRG-OS-000304-GPOS-00121, SRG-OS-000392-GPOS-00172, SRG-OS-000462-GPOS-00206, SRG-OS-000470-GPOS-00214, SRG-OS-000471-GPOS-00215, SRG-OS-000239-GPOS-00089, SRG-OS-000240-GPOS-00090, SRG-OS-000241-GPOS-00091, SRG-OS-000303-GPOS-00120, SRG-OS-000466-GPOS-00210, SRG-OS-000476-GPOS-00221 |
| Description | At a minimum, the audit system should collect administrator actions
for all users and root. If the auditd daemon is configured to use the
augenrules program to read audit rules during daemon startup (the default),
add the following line to a file with suffix .rules in the directory
/etc/audit/rules.d:
-w /etc/sudoers.d/ -p wa -k actionsIf the auditd daemon is configured to use the auditctl
utility to read audit rules during daemon startup, add the following line to
/etc/audit/audit.rules file:
-w /etc/sudoers.d/ -p wa -k actions |
| Rationale | The actions taken by system administrators should be audited to keep a record
of what was executed on the system, as well as, for accountability purposes.
Editing the sudoers file may be sign of an attacker trying to
establish persistent methods to a system, auditing the editing of the sudoers
files mitigates this risk. |
audit augenrules oval:ssg-test_audit_rules_augenrules:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /usr/lib/systemd/system/auditd.service | ExecStartPost=-/sbin/augenrules --load |
audit augenrules sudoers oval:ssg-test_audit_rules_sudoers_d_augenrules:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_sudoers_d_augenrules:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| ^/etc/audit/rules\.d/.*\.rules$ | ^\-w[\s]+/etc/sudoers\.d/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$ | 1 |
audit auditctl oval:ssg-test_audit_rules_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /usr/lib/systemd/system/auditd.service | ^ExecStartPost=\-\/sbin\/auditctl.*$ | 1 |
audit auditctl sudoers oval:ssg-test_audit_rules_sudoers_d_auditctl:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_audit_rules_sudoers_d_auditctl:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/audit.rules | ^\-w[\s]+/etc/sudoers\.d/[\s]+\-p[\s]+\b([rx]*w[rx]*a[rx]*|[rx]*a[rx]*w[rx]*)\b.*$ | 1 |
System Audit Directories Must Be Group Owned By Root
| Rule ID | xccdf_org.ssgproject.content_rule_directory_group_ownership_var_log_audit |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-directory_group_ownership_var_log_audit:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-90516-6 References: 1, 11, 12, 13, 14, 15, 16, 18, 19, 3, 4, 5, 6, 7, 8, 5.4.1.1, APO01.06, APO11.04, APO12.06, BAI03.05, BAI08.02, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS05.04, DSS05.07, DSS06.02, MEA02.01, 3.3.1, CCI-000162, CCI-000163, CCI-000164, CCI-001314, 4.2.3.10, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.7.3, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.1, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 5.2, SR 6.1, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.16.1.4, A.16.1.5, A.16.1.7, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), AC-6(1), AU-9(4), DE.AE-3, DE.AE-5, PR.AC-4, PR.DS-5, PR.PT-1, RS.AN-1, RS.AN-4, Req-10.5.1, SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000206-GPOS-00084 |
| Description | All audit directories must be group owned by root user. By default, the path for audit log is /var/log/audit/. To properly set the group owner of /var/log/audit, run the command:
$ sudo chgrp root /var/log/auditIf log_group in /etc/audit/auditd.conf is set to a group other than the root
group account, change the group ownership of the audit directories to this specific group. |
| Rationale | Unauthorized disclosure of audit records can reveal system and configuration data to
attackers, thus compromising its confidentiality. |
log_file not set oval:ssg-test_auditd_conf_log_file_not_set:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_auditd_conf_log_file:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/auditd.conf | ^(log_file\s*=\s*.*)$ | 1 |
/var/log/audit directories uid root gid root oval:ssg-test_group_ownership_var_log_audit_directories:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_group_ownership_var_log_audit_directories:obj:1 of type file_object
| Behaviors | Path | Filename | Filter |
|---|---|---|---|
| Referenced variable has no values (oval:ssg-audit_log_dir_group_ownership:var:1). | no value | no value | oval:ssg-state_group_owner_not_root_var_log_audit_directories:ste:1 |
log_file not set oval:ssg-test_auditd_conf_log_file_not_set:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_auditd_conf_log_file:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/auditd.conf | ^(log_file\s*=\s*.*)$ | 1 |
/var/log/audit directories uid root gid root oval:ssg-test_group_ownership_default_var_log_audit_directories:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_group_ownership_default_var_log_audit_directories:obj:1 of type file_object
| Behaviors | Path | Filename | Filter |
|---|---|---|---|
| no value | /var/log/audit | no value | oval:ssg-state_group_owner_not_root_var_log_audit_directories:ste:1 |
log_group = root oval:ssg-test_auditd_conf_log_group_not_root:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_auditd_conf_log_group_root:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/auditd.conf | ^[ ]*log_group[ ]+=[ ]+root[ ]*$ | 1 |
log_group is set oval:ssg-test_auditd_conf_log_group_is_set:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_auditd_conf_log_group_is_set:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/auditd.conf | ^[ ]*log_group[ ]+=.*$ | 1 |
/var/log/audit directories uid root gid root oval:ssg-test_group_ownership_var_log_audit_directories-non_root:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_group_ownership_var_log_audit_directories-non_root:obj:1 of type file_object
| Behaviors | Path | Filename | Filter |
|---|---|---|---|
| no value | /var/log/audit | no value | oval:ssg-state_group_owner_not_root_var_log_audit_directories-non_root:ste:1 |
System Audit Directories Must Be Owned By Root
| Rule ID | xccdf_org.ssgproject.content_rule_directory_ownership_var_log_audit |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-directory_ownership_var_log_audit:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-85869-6 References: 1, 11, 12, 13, 14, 15, 16, 18, 19, 3, 4, 5, 6, 7, 8, 5.4.1.1, APO01.06, APO11.04, APO12.06, BAI03.05, BAI08.02, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS05.04, DSS05.07, DSS06.02, MEA02.01, 3.3.1, CCI-000162, CCI-000163, CCI-000164, CCI-001314, 4.2.3.10, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.7.3, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.1, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 5.2, SR 6.1, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.16.1.4, A.16.1.5, A.16.1.7, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), AC-6(1), AU-9(4), DE.AE-3, DE.AE-5, PR.AC-4, PR.DS-5, PR.PT-1, RS.AN-1, RS.AN-4, Req-10.5.1, SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000206-GPOS-00084 |
| Description | All audit directories must be owned by root user. By default, the path for audit log is /var/log/audit/. To properly set the owner of /var/log/audit, run the command:
$ sudo chown root /var/log/audit |
| Rationale | Unauthorized disclosure of audit records can reveal system and configuration data to
attackers, thus compromising its confidentiality. |
log_file not set oval:ssg-test_auditd_conf_log_file_not_set:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_auditd_conf_log_file:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/auditd.conf | ^(log_file\s*=\s*.*)$ | 1 |
log_file's directory uid root gid root oval:ssg-test_user_ownership_var_log_audit_path:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_user_ownership_var_log_audit_path:obj:1 of type file_object
| Path | Filename | Filter |
|---|---|---|
| Referenced variable has no values (oval:ssg-var_directory_ownership_var_log_audit_path:var:1). | no value | oval:ssg-state_owner_not_root_var_log_audit_directories:ste:1 |
log_file not set oval:ssg-test_auditd_conf_log_file_not_set:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_auditd_conf_log_file:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/auditd.conf | ^(log_file\s*=\s*.*)$ | 1 |
/var/log/audit directories uid root gid root oval:ssg-test_user_ownership_var_log_audit_directories:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_user_ownership_var_log_audit_directories:obj:1 of type file_object
| Path | Filename | Filter |
|---|---|---|
| /var/log/audit | no value | oval:ssg-state_owner_not_root_var_log_audit_directories:ste:1 |
System Audit Logs Must Be Group Owned By Root
| Rule ID | xccdf_org.ssgproject.content_rule_file_group_ownership_var_log_audit |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_group_ownership_var_log_audit:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-89603-5 References: 1, 11, 12, 13, 14, 15, 16, 18, 19, 3, 4, 5, 6, 7, 8, 5.4.1.1, APO01.06, APO11.04, APO12.06, BAI03.05, BAI08.02, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS05.04, DSS05.07, DSS06.02, MEA02.01, 3.3.1, CCI-000162, CCI-000163, CCI-000164, CCI-001314, 4.2.3.10, 4.3.3.3.9, 4.3.3.5.8, 4.3.3.7.3, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.1, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 5.2, SR 6.1, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.16.1.4, A.16.1.5, A.16.1.7, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), AC-6(1), AU-9(4), DE.AE-3, DE.AE-5, PR.AC-4, PR.DS-5, PR.PT-1, RS.AN-1, RS.AN-4, Req-10.5.1, SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000206-GPOS-00084, 4.1.4.3 |
| Description | All audit logs must be group owned by root user. The path for audit log can
be configured via log_file parameter in /etc/audit/auditd.confor, by default, the path for audit log is /var/log/audit/. To properly set the group owner of /var/log/audit/*, run the command:
$ sudo chgrp root /var/log/audit/*If log_group in /etc/audit/auditd.conf is set to a group other
than the root group account, change the group ownership of the audit logs
to this specific group. |
| Rationale | Unauthorized disclosure of audit records can reveal system and configuration data to
attackers, thus compromising its confidentiality. |
log_file not set oval:ssg-test_auditd_conf_log_file_not_set:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_auditd_conf_log_file:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/auditd.conf | ^(log_file\s*=\s*.*)$ | 1 |
audit log files gid root oval:ssg-test_group_ownership_audit_log_files:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_group_ownership_audit_log_files:obj:1 of type file_object
| Filepath | Filter |
|---|---|
| Referenced variable has no values (oval:ssg-audit_log_file_path:var:1). | oval:ssg-state_group_owner_not_root_var_log_audit:ste:1 |
log_group = root oval:ssg-test_auditd_conf_log_group_not_root:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_auditd_conf_log_group_root:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/auditd.conf | ^[ ]*log_group[ ]+=[ ]+root[ ]*$ | 1 |
log_group is set oval:ssg-test_auditd_conf_log_group_is_set:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_auditd_conf_log_group_is_set:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/auditd.conf | ^[ ]*log_group[ ]+=.*$ | 1 |
log_file not set oval:ssg-test_auditd_conf_log_file_not_set:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_auditd_conf_log_file:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/auditd.conf | ^(log_file\s*=\s*.*)$ | 1 |
audit log files gid root oval:ssg-test_group_ownership_default_audit_log_files:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_group_ownership_default_audit_log_files:obj:1 of type file_object
| Filepath | Filter |
|---|---|
| /var/log/audit/audit.log | oval:ssg-state_group_owner_not_root_var_log_audit:ste:1 |
log_group = root oval:ssg-test_auditd_conf_log_group_not_root:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_auditd_conf_log_group_root:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/auditd.conf | ^[ ]*log_group[ ]+=[ ]+root[ ]*$ | 1 |
log_group is set oval:ssg-test_auditd_conf_log_group_is_set:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_auditd_conf_log_group_is_set:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/auditd.conf | ^[ ]*log_group[ ]+=.*$ | 1 |
Configure audispd's Plugin disk_full_action When Disk Is Full
| Rule ID | xccdf_org.ssgproject.content_rule_auditd_audispd_disk_full_action |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-auditd_audispd_disk_full_action:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-88477-5 References: CCI-001851, AU-5(b), AU-5(2), AU-5(1), AU-5(4), CM-6(a), SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224 |
| Description | Configure the action the operating system takes if the disk the audit records
are written to becomes full. Edit the file /etc/audit/audisp-remote.conf.
Add or modify the following line, substituting ACTION appropriately:
disk_full_action = ACTIONSet this value to single to cause the system to switch to single user
mode for corrective action. Acceptable values also include syslog and
halt. For certain systems, the need for availability
outweighs the need to log all actions, and a different setting should be
determined. |
| Rationale | Taking appropriate action in case of a filled audit storage volume will
minimize the possibility of losing audit records. |
the action the operating system takes if there is an error sending audit records to a remote system oval:ssg-test_auditd_audispd_disk_full_action:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_auditd_audispd_disk_full_action:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/audisp-remote.conf | ^[ ]*disk_full_action[ ]+=[ ]+(\S+)[ ]*$ | 1 |
Configure auditd Disk Error Action on Disk Error
| Rule ID | xccdf_org.ssgproject.content_rule_auditd_data_disk_error_action |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-auditd_data_disk_error_action:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83690-8 References: 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, APO11.04, APO12.06, APO13.01, BAI03.05, BAI04.04, BAI08.02, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS05.04, DSS05.07, MEA02.01, CCI-000140, 4.2.3.10, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.16.1.4, A.16.1.5, A.16.1.7, A.17.2.1, AU-5(b), AU-5(2), AU-5(1), AU-5(4), CM-6(a), DE.AE-3, DE.AE-5, PR.DS-4, PR.PT-1, RS.AN-1, RS.AN-4, SRG-OS-000047-GPOS-00023 |
| Description | The auditd service can be configured to take an action
when there is a disk error.
Edit the file /etc/audit/auditd.conf. Add or modify the following line,
substituting ACTION appropriately:
disk_error_action = ACTIONSet this value to single to cause the system to switch to single-user
mode for corrective action. Acceptable values also include syslog,
exec, single, and halt. For certain systems, the need for availability
outweighs the need to log all actions, and a different setting should be
determined. Details regarding all possible values for ACTION are described in the
auditd.conf man page. |
| Rationale | Taking appropriate action in case of disk errors will minimize the possibility of
losing audit records. |
disk full action oval:ssg-test_auditd_data_disk_error_action:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_auditd_data_disk_error_action:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/auditd.conf | ^[ ]*disk_error_action[ ]+=[ ]+(\S+)[ ]*$ | 1 |
Configure auditd Disk Error Action on Disk Error
| Rule ID | xccdf_org.ssgproject.content_rule_auditd_data_disk_error_action_stig |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-auditd_data_disk_error_action_stig:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-88303-3 References: 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, APO11.04, APO12.06, APO13.01, BAI03.05, BAI04.04, BAI08.02, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS05.04, DSS05.07, MEA02.01, CCI-000140, 4.2.3.10, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.16.1.4, A.16.1.5, A.16.1.7, A.17.2.1, AU-5(b), AU-5(2), AU-5(1), AU-5(4), CM-6(a), DE.AE-3, DE.AE-5, PR.DS-4, PR.PT-1, RS.AN-1, RS.AN-4, SRG-OS-000047-GPOS-00023 |
| Description | The auditd service can be configured to take an action
when there is a disk error.
Edit the file /etc/audit/auditd.conf. Add or modify the following line,
substituting ACTION appropriately:
disk_error_action = ACTIONSet this value to single to cause the system to switch to single-user
mode for corrective action. Acceptable values also include syslog,
exec, single, and halt. For certain systems, the need for availability
outweighs the need to log all actions, and a different setting should be
determined. Details regarding all possible values for ACTION are described in the
auditd.conf man page. |
| Rationale | Taking appropriate action in case of disk errors will minimize the possibility of
losing audit records. |
disk full action oval:ssg-test_auditd_data_disk_error_action_stig_syslog:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_auditd_data_disk_error_action_stig:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/auditd.conf | ^[ ]*disk_error_action[ ]+=[ ]+(\S+)[ ]*$ | 1 |
disk full action oval:ssg-test_auditd_data_disk_error_action_stig_single:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_auditd_data_disk_error_action_stig:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/auditd.conf | ^[ ]*disk_error_action[ ]+=[ ]+(\S+)[ ]*$ | 1 |
disk full action oval:ssg-test_auditd_data_disk_error_action_stig_halt:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_auditd_data_disk_error_action_stig:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/auditd.conf | ^[ ]*disk_error_action[ ]+=[ ]+(\S+)[ ]*$ | 1 |
Configure auditd Disk Full Action when Disk Space Is Full
| Rule ID | xccdf_org.ssgproject.content_rule_auditd_data_disk_full_action |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-auditd_data_disk_full_action:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83684-1 References: 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, APO11.04, APO12.06, APO13.01, BAI03.05, BAI04.04, BAI08.02, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS05.04, DSS05.07, MEA02.01, CCI-000140, 4.2.3.10, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.16.1.4, A.16.1.5, A.16.1.7, A.17.2.1, AU-5(b), AU-5(2), AU-5(1), AU-5(4), CM-6(a), DE.AE-3, DE.AE-5, PR.DS-4, PR.PT-1, RS.AN-1, RS.AN-4, SRG-OS-000047-GPOS-00023 |
| Description | The auditd service can be configured to take an action
when disk space is running low but prior to running out of space completely.
Edit the file /etc/audit/auditd.conf. Add or modify the following line,
substituting ACTION appropriately:
disk_full_action = ACTIONSet this value to single to cause the system to switch to single-user
mode for corrective action. Acceptable values also include syslog,
exec,
single, and halt. For certain systems, the need for availability
outweighs the need to log all actions, and a different setting should be
determined. Details regarding all possible values for ACTION are described in the
auditd.conf man page. |
| Rationale | Taking appropriate action in case of a filled audit storage volume will minimize
the possibility of losing audit records. |
disk error action oval:ssg-test_auditd_data_disk_full_action:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_auditd_data_disk_full_action:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/auditd.conf | ^[ ]*disk_full_action[ ]+=[ ]+(\S+)[ ]*$ | 1 |
Configure auditd Disk Full Action when Disk Space Is Full
| Rule ID | xccdf_org.ssgproject.content_rule_auditd_data_disk_full_action_stig |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-auditd_data_disk_full_action_stig:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-88336-3 References: 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, APO11.04, APO12.06, APO13.01, BAI03.05, BAI04.04, BAI08.02, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS05.04, DSS05.07, MEA02.01, CCI-000140, 4.2.3.10, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.16.1.4, A.16.1.5, A.16.1.7, A.17.2.1, AU-5(b), AU-5(2), AU-5(1), AU-5(4), CM-6(a), DE.AE-3, DE.AE-5, PR.DS-4, PR.PT-1, RS.AN-1, RS.AN-4, SRG-OS-000047-GPOS-00023 |
| Description | The auditd service can be configured to take an action
when disk space is running low but prior to running out of space completely.
Edit the file /etc/audit/auditd.conf. Add or modify the following line,
substituting ACTION appropriately:
disk_full_action = ACTIONSet this value to single to cause the system to switch to single-user
mode for corrective action. Acceptable values also include syslog,
single, and halt. For certain systems, the need for availability
outweighs the need to log all actions, and a different setting should be
determined. Details regarding all possible values for ACTION are described in the
auditd.conf man page. |
| Rationale | Taking appropriate action in case of a filled audit storage volume will minimize
the possibility of losing audit records. |
disk full action oval:ssg-test_auditd_data_disk_full_action_stig_syslog:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_auditd_data_disk_full_action_stig:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/auditd.conf | ^[ ]*disk_full_action[ ]+=[ ]+(\S+)[ ]*$ | 1 |
disk full action oval:ssg-test_auditd_data_disk_full_action_stig_single:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_auditd_data_disk_full_action_stig:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/auditd.conf | ^[ ]*disk_full_action[ ]+=[ ]+(\S+)[ ]*$ | 1 |
disk full action oval:ssg-test_auditd_data_disk_full_action_stig_halt:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_auditd_data_disk_full_action_stig:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/auditd.conf | ^[ ]*disk_full_action[ ]+=[ ]+(\S+)[ ]*$ | 1 |
Configure auditd mail_acct Action on Low Disk Space
| Rule ID | xccdf_org.ssgproject.content_rule_auditd_data_retention_action_mail_acct |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-auditd_data_retention_action_mail_acct:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83698-1 References: 1, 11, 12, 13, 14, 15, 16, 19, 2, 3, 4, 5, 6, 7, 8, 5.4.1.1, APO11.04, APO12.06, APO13.01, BAI03.05, BAI04.04, BAI08.02, DSS02.02, DSS02.04, DSS02.07, DSS03.01, DSS05.04, DSS05.07, MEA02.01, 3.3.1, CCI-000139, CCI-001855, 164.312(a)(2)(ii), 4.2.3.10, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.3.4.5.6, 4.3.4.5.7, 4.3.4.5.8, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.16.1.4, A.16.1.5, A.16.1.7, A.17.2.1, CIP-003-8 R1.3, CIP-003-8 R3, CIP-003-8 R3.1, CIP-003-8 R3.2, CIP-003-8 R3.3, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, IA-5(1), AU-5(a), AU-5(2), CM-6(a), DE.AE-3, DE.AE-5, PR.DS-4, PR.PT-1, RS.AN-1, RS.AN-4, Req-10.7.a, SRG-OS-000046-GPOS-00022, SRG-OS-000343-GPOS-00134, SRG-OS-000046-VMM-000210, SRG-OS-000343-VMM-001240, 4.1.2.3 |
| Description | The auditd service can be configured to send email to
a designated account in certain situations. Add or correct the following line
in /etc/audit/auditd.conf to ensure that administrators are notified
via email for those situations:
action_mail_acct = root |
| Rationale | Email sent to the root account is typically aliased to the
administrators of the system, who can take appropriate action. |
email account for actions oval:ssg-test_auditd_data_retention_action_mail_acct:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_auditd_data_retention_action_mail_acct:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/audit/auditd.conf | ^[ ]*action_mail_acct[ ]+=[ ]+(\S+)[ ]*$ | 1 |
Verify /boot/grub2/grub.cfg Group Ownership
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_grub2_cfg |
| Result | notapplicable |
| Multi-check rule | no |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83848-2 References: 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2.2, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.4.5, CCI-000225, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-7.1, SRG-OS-000480-GPOS-00227, 1.4.2 |
| Description | The file /boot/grub2/grub.cfg should
be group-owned by the root group to prevent
destruction or modification of the file.
To properly set the group owner of /boot/grub2/grub.cfg, run the command:
$ sudo chgrp root /boot/grub2/grub.cfg |
| Rationale | The root group is a highly-privileged group. Furthermore, the group-owner of this
file should not have any access privileges anyway. |
Verify /boot/grub2/user.cfg Group Ownership
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_user_cfg |
| Result | notapplicable |
| Multi-check rule | no |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-86010-6 References: 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2.2, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.4.5, CCI-000225, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-7.1, SRG-OS-000480-GPOS-00227, 1.4.2 |
| Description | The file /boot/grub2/user.cfg should be group-owned by the root
group to prevent reading or modification of the file.
To properly set the group owner of /boot/grub2/user.cfg, run the command:
$ sudo chgrp root /boot/grub2/user.cfg |
| Rationale | The root group is a highly-privileged group. Furthermore, the group-owner of this
file should not have any access privileges anyway. Non-root users who read the boot parameters
may be able to identify weaknesses in security upon boot and be able to exploit them. |
Verify /boot/grub2/grub.cfg User Ownership
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_grub2_cfg |
| Result | notapplicable |
| Multi-check rule | no |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83845-8 References: 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2.2, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.4.5, CCI-000225, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-7.1, 1.4.2 |
| Description | The file /boot/grub2/grub.cfg should
be owned by the root user to prevent destruction
or modification of the file.
To properly set the owner of /boot/grub2/grub.cfg, run the command:
$ sudo chown root /boot/grub2/grub.cfg |
| Rationale | Only root should be able to modify important boot parameters. |
Verify /boot/grub2/user.cfg User Ownership
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_user_cfg |
| Result | notapplicable |
| Multi-check rule | no |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-86016-3 References: 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2.2, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.4.5, CCI-000225, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-7.1, 1.4.2 |
| Description | The file /boot/grub2/user.cfg should be owned by the root
user to prevent reading or modification of the file.
To properly set the owner of /boot/grub2/user.cfg, run the command:
$ sudo chown root /boot/grub2/user.cfg |
| Rationale | Only root should be able to modify important boot parameters. Also, non-root users who read
the boot parameters may be able to identify weaknesses in security upon boot and be able to
exploit them. |
Set Boot Loader Password in grub2
| Rule ID | xccdf_org.ssgproject.content_rule_grub2_password |
| Result | notapplicable |
| Multi-check rule | no |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | high |
| Identifiers and References | Identifiers: CCE-83849-0 References: BP28(R17), 1, 11, 12, 14, 15, 16, 18, 3, 5, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.06, DSS06.10, 3.4.5, CCI-000213, 164.308(a)(1)(ii)(B), 164.308(a)(7)(i), 164.308(a)(7)(ii)(A), 164.310(a)(1), 164.310(a)(2)(i), 164.310(a)(2)(ii), 164.310(a)(2)(iii), 164.310(b), 164.310(c), 164.310(d)(1), 164.310(d)(2)(iii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, A.18.1.4, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, CM-6(a), PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.PT-3, FIA_UAU.1, SRG-OS-000080-GPOS-00048, 1.4.1 |
| Description | The grub2 boot loader should have a superuser account and password
protection enabled to protect boot-time settings.
Since plaintext passwords are a security risk, generate a hash for the password by running the following command: # grub2-setpasswordWhen prompted, enter the password that was selected. |
| Rationale | Password protection on the boot loader configuration ensures
users with physical access cannot trivially alter
important bootloader settings. These include which kernel to use,
and whether to enter single-user mode. |
| Warnings | warning
To prevent hard-coded passwords, automatic remediation of this control is not available. Remediation
must be automated as a component of machine provisioning, or followed manually as outlined above.
Also, do NOT manually add the superuser account and password to the
grub.cfg file as the grub2-mkconfig command overwrites this file. |
Enable systemd-journald Service
| Rule ID | xccdf_org.ssgproject.content_rule_service_systemd-journald_enabled |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_systemd-journald_enabled:def:1 |
| Time | 2023-07-10T14:10:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-85941-3 References: CCI-001665, SC-24, SRG-OS-000269-GPOS-00103, 4.2.2.2 |
| Description | The systemd-journald service is an essential component of
systemd.
The systemd-journald service can be enabled with the following command:
$ sudo systemctl enable systemd-journald.service |
| Rationale | In the event of a system failure, Red Hat Enterprise Linux 9 must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to system processes. |
package systemd is installed oval:ssg-test_service_systemd-journald_package_systemd_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| systemd | x86_64 | (none) | 13.el9_2 | 252 | 0:252-13.el9_2 | 199e2f91fd431d51 | systemd-0:252-13.el9_2.x86_64 |
Test that the systemd-journald service is running oval:ssg-test_service_running_systemd-journald:tst:1 true
Following items have been found on the system:
| Unit | Property | Value |
|---|---|---|
| systemd-journald.service | ActiveState | active |
| systemd-journald.socket | ActiveState | active |
systemd test oval:ssg-test_multi_user_wants_systemd-journald:tst:1 true
Following items have been found on the system:
| Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| multi-user.target | basic.target | -.mount | sysinit.target | systemd-sysusers.service | systemd-sysctl.service | sys-fs-fuse-connections.mount | local-fs.target | boot-efi.mount | boot.mount | systemd-remount-fs.service | ostree-remount.service | ldconfig.service | systemd-repart.service | systemd-tmpfiles-setup.service | sys-kernel-debug.mount | systemd-udevd.service | selinux-autorelabel-mark.service | cryptsetup.target | systemd-pcrphase-sysinit.service | dev-hugepages.mount | iscsi-onboot.service | systemd-journal-flush.service | systemd-ask-password-console.path | swap.target | dev-mapper-rhel\x2dswap.swap | systemd-tmpfiles-setup-dev.service | dev-mqueue.mount | lvm2-lvmpolld.socket | multipathd.service | sys-kernel-config.mount | systemd-boot-system-token.service | systemd-random-seed.service | systemd-journal-catalog-update.service | systemd-udev-trigger.service | systemd-hwdb-update.service | plymouth-start.service | dracut-shutdown.service | systemd-update-done.service | systemd-pcrphase.service | veritysetup.target | lvm2-monitor.service | integritysetup.target | systemd-network-generator.service | systemd-boot-update.service | systemd-journald.service | proc-sys-fs-binfmt_misc.automount | sys-kernel-tracing.mount | systemd-firstboot.service | systemd-binfmt.service | systemd-modules-load.service | systemd-machine-id-commit.service | plymouth-read-write.service | kmod-static-nodes.service | systemd-update-utmp.service | nis-domainname.service | slices.target | -.slice | system.slice | microcode.service | low-memory-monitor.service | timers.target | systemd-tmpfiles-clean.timer | mlocate-updatedb.timer | logrotate.timer | dnf-makecache.timer | sockets.target | dbus.socket | multipathd.socket | iscsiuio.socket | avahi-daemon.socket | sssd-kcm.socket | systemd-udevd-kernel.socket | dm-event.socket | systemd-initctl.socket | cups.socket | systemd-coredump.socket | systemd-journald.socket | iscsid.socket | systemd-journald-dev-log.socket | systemd-udevd-control.socket | paths.target | ostree-readonly-sysroot-migration.service | mcelog.service | plymouth-quit.service | ModemManager.service | libstoragemgmt.service | smartd.service | plymouth-quit-wait.service | NetworkManager.service | irqbalance.service | avahi-daemon.service | remote-fs.target | iscsi.service | insights-client-boot.service | sshd.service | chronyd.service | cups.service | getty.target | getty@tty1.service | tuned.service | auditd.service | kdump.service | vmtoolsd.service | crond.service | firewalld.service | systemd-ask-password-wall.path | rsyslog.service | cups.path | systemd-logind.service | rhsmcertd.service | atd.service | sssd.service | systemd-update-utmp-runlevel.service | mdmonitor.service | systemd-user-sessions.service |
systemd test oval:ssg-test_multi_user_wants_systemd-journald_socket:tst:1 true
Following items have been found on the system:
| Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| multi-user.target | basic.target | -.mount | sysinit.target | systemd-sysusers.service | systemd-sysctl.service | sys-fs-fuse-connections.mount | local-fs.target | boot-efi.mount | boot.mount | systemd-remount-fs.service | ostree-remount.service | ldconfig.service | systemd-repart.service | systemd-tmpfiles-setup.service | sys-kernel-debug.mount | systemd-udevd.service | selinux-autorelabel-mark.service | cryptsetup.target | systemd-pcrphase-sysinit.service | dev-hugepages.mount | iscsi-onboot.service | systemd-journal-flush.service | systemd-ask-password-console.path | swap.target | dev-mapper-rhel\x2dswap.swap | systemd-tmpfiles-setup-dev.service | dev-mqueue.mount | lvm2-lvmpolld.socket | multipathd.service | sys-kernel-config.mount | systemd-boot-system-token.service | systemd-random-seed.service | systemd-journal-catalog-update.service | systemd-udev-trigger.service | systemd-hwdb-update.service | plymouth-start.service | dracut-shutdown.service | systemd-update-done.service | systemd-pcrphase.service | veritysetup.target | lvm2-monitor.service | integritysetup.target | systemd-network-generator.service | systemd-boot-update.service | systemd-journald.service | proc-sys-fs-binfmt_misc.automount | sys-kernel-tracing.mount | systemd-firstboot.service | systemd-binfmt.service | systemd-modules-load.service | systemd-machine-id-commit.service | plymouth-read-write.service | kmod-static-nodes.service | systemd-update-utmp.service | nis-domainname.service | slices.target | -.slice | system.slice | microcode.service | low-memory-monitor.service | timers.target | systemd-tmpfiles-clean.timer | mlocate-updatedb.timer | logrotate.timer | dnf-makecache.timer | sockets.target | dbus.socket | multipathd.socket | iscsiuio.socket | avahi-daemon.socket | sssd-kcm.socket | systemd-udevd-kernel.socket | dm-event.socket | systemd-initctl.socket | cups.socket | systemd-coredump.socket | systemd-journald.socket | iscsid.socket | systemd-journald-dev-log.socket | systemd-udevd-control.socket | paths.target | ostree-readonly-sysroot-migration.service | mcelog.service | plymouth-quit.service | ModemManager.service | libstoragemgmt.service | smartd.service | plymouth-quit-wait.service | NetworkManager.service | irqbalance.service | avahi-daemon.service | remote-fs.target | iscsi.service | insights-client-boot.service | sshd.service | chronyd.service | cups.service | getty.target | getty@tty1.service | tuned.service | auditd.service | kdump.service | vmtoolsd.service | crond.service | firewalld.service | systemd-ask-password-wall.path | rsyslog.service | cups.path | systemd-logind.service | rhsmcertd.service | atd.service | sssd.service | systemd-update-utmp-runlevel.service | mdmonitor.service | systemd-user-sessions.service |
Ensure journald is configured to compress large log files
| Rule ID | xccdf_org.ssgproject.content_rule_journald_compress |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-journald_compress:def:1 |
| Time | 2023-07-10T14:10:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-85931-4 References: 4.2.2.3 |
| Description | The journald system can compress large log files to avoid fill the system disk. |
| Rationale | Log files that are not properly compressed run the risk of growing so large that they fill up the log partition. Valuable logging information could be lost if the log partition becomes full. |
tests the value of Compress setting in the /etc/systemd/journald.conf file oval:ssg-test_journald_compress:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_journald_compress:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/systemd/journald.conf | ^[ \t]*Compress=(.+?)[ \t]*(?:$|#) | 1 |
Ensure journald is configured to send logs to rsyslog
| Rule ID | xccdf_org.ssgproject.content_rule_journald_forward_to_syslog |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-journald_forward_to_syslog:def:1 |
| Time | 2023-07-10T14:10:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-85996-7 References: 4.2.1.3 |
| Description | Data from journald may be stored in volatile memory or persisted locally.
Utilities exist to accept remote export of journald logs. |
| Rationale | Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system. |
tests the value of ForwardToSyslog setting in the /etc/systemd/journald.conf file oval:ssg-test_journald_forward_to_syslog:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_journald_forward_to_syslog:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/systemd/journald.conf | ^[ \t]*ForwardToSyslog=(.+?)[ \t]*(?:$|#) | 1 |
Ensure journald is configured to write log files to persistent disk
| Rule ID | xccdf_org.ssgproject.content_rule_journald_storage |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-journald_storage:def:1 |
| Time | 2023-07-10T14:10:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-86046-0 References: 4.2.2.4 |
| Description | The journald system may store log files in volatile memory or locally on disk.
If the logs are only stored in volatile memory they will we lost upon reboot. |
| Rationale | Log files contain valuable data and need to be persistent to aid in possible investigations. |
tests the value of Storage setting in the /etc/systemd/journald.conf file oval:ssg-test_journald_storage:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_journald_storage:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/systemd/journald.conf | ^[ \t]*Storage=(.+?)[ \t]*(?:$|#) | 1 |
Ensure rsyslog Does Not Accept Remote Messages Unless Acting As Log Server
| Rule ID | xccdf_org.ssgproject.content_rule_rsyslog_nolisten |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-rsyslog_nolisten:def:1 |
| Time | 2023-07-10T14:10:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83995-1 References: 1, 11, 12, 13, 14, 15, 16, 18, 3, 4, 5, 6, 8, 9, APO01.06, APO11.04, APO13.01, BAI03.05, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.05, DSS03.01, DSS05.02, DSS05.04, DSS05.07, DSS06.02, MEA02.01, CCI-000318, CCI-000366, CCI-000368, CCI-001812, CCI-001813, CCI-001814, 4.2.3.4, 4.3.3.3.9, 4.3.3.4, 4.3.3.5.8, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, 4.4.3.3, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, 0988, 1405, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.5.1, A.12.6.2, A.12.7.1, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-7(a), CM-7(b), CM-6(a), DE.AE-1, ID.AM-3, PR.AC-5, PR.DS-5, PR.IP-1, PR.PT-1, PR.PT-4, SRG-OS-000480-GPOS-00227, 4.2.1.7 |
| Description | The rsyslog daemon should not accept remote messages
unless the system acts as a log server.
To ensure that it is not listening on the network, ensure the following lines are
not found in /etc/rsyslog.conf:
$ModLoad imtcp $InputTCPServerRun port $ModLoad imudp $UDPServerRun port $ModLoad imrelp $InputRELPServerRun port |
| Rationale | Any process which receives messages from the network incurs some risk
of receiving malicious messages. This risk can be eliminated for
rsyslog by configuring it not to listen on the network. |
Ensure that the /etc/rsyslog.conf does not contain $InputTCPServerRun | $UDPServerRun | $InputRELPServerRun | $ModLoad imtcp | $ModLoad imudp | $ModLoad imrelp oval:ssg-test_rsyslog_nolisten:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_rsyslog_nolisten:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/rsyslog.conf | ^[\s]*\$((?:Input(?:TCP|RELP)|UDP)ServerRun|ModLoad[\s]+(imtcp|imudp|imrelp)) | 1 |
Ensure rsyslog is Installed
| Rule ID | xccdf_org.ssgproject.content_rule_package_rsyslog_installed |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_rsyslog_installed:def:1 |
| Time | 2023-07-10T14:10:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84063-7 References: BP28(R5), NT28(R46), 1, 14, 15, 16, 3, 5, 6, APO11.04, BAI03.05, DSS05.04, DSS05.07, MEA02.01, CCI-001311, CCI-001312, CCI-000366, 164.312(a)(2)(ii), 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, CM-6(a), PR.PT-1, FTP_ITC_EXT.1.1, SRG-OS-000479-GPOS-00224, SRG-OS-000051-GPOS-00024, SRG-OS-000480-GPOS-00227, 4.2.1.1 |
| Description | Rsyslog is installed by default. The rsyslog package can be installed with the following command: $ sudo dnf install rsyslog |
| Rationale | The rsyslog package provides the rsyslog daemon, which provides
system logging services. |
package rsyslog is installed oval:ssg-test_package_rsyslog_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| rsyslog | x86_64 | (none) | 111.el9 | 8.2102.0 | 0:8.2102.0-111.el9 | 199e2f91fd431d51 | rsyslog-0:8.2102.0-111.el9.x86_64 |
Enable rsyslog Service
| Rule ID | xccdf_org.ssgproject.content_rule_service_rsyslog_enabled |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_rsyslog_enabled:def:1 |
| Time | 2023-07-10T14:10:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83989-4 References: BP28(R5), NT28(R46), 1, 12, 13, 14, 15, 16, 2, 3, 5, 6, 7, 8, 9, APO10.01, APO10.03, APO10.04, APO10.05, APO11.04, APO13.01, BAI03.05, BAI04.04, DSS01.03, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, MEA01.01, MEA01.02, MEA01.03, MEA01.04, MEA01.05, MEA02.01, CCI-001311, CCI-001312, CCI-001557, CCI-001851, CCI-000366, 164.312(a)(2)(ii), 4.3.2.6.7, 4.3.3.3.9, 4.3.3.5.8, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 2.10, SR 2.11, SR 2.12, SR 2.8, SR 2.9, SR 6.1, SR 6.2, SR 7.1, SR 7.2, A.12.1.3, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.14.2.7, A.15.2.1, A.15.2.2, A.17.2.1, CM-6(a), AU-4(1), DE.CM-1, DE.CM-3, DE.CM-7, ID.SC-4, PR.DS-4, PR.PT-1, SRG-OS-000480-GPOS-00227, 4.2.1.2 |
| Description | The rsyslog service provides syslog-style logging by default on Red Hat Enterprise Linux 9.
The rsyslog service can be enabled with the following command:
$ sudo systemctl enable rsyslog.service |
| Rationale | The rsyslog service must be running in order to provide
logging services, which are essential to system administration. |
package rsyslog is installed oval:ssg-test_service_rsyslog_package_rsyslog_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| rsyslog | x86_64 | (none) | 111.el9 | 8.2102.0 | 0:8.2102.0-111.el9 | 199e2f91fd431d51 | rsyslog-0:8.2102.0-111.el9.x86_64 |
Test that the rsyslog service is running oval:ssg-test_service_running_rsyslog:tst:1 true
Following items have been found on the system:
| Unit | Property | Value |
|---|---|---|
| rsyslog.service | ActiveState | active |
systemd test oval:ssg-test_multi_user_wants_rsyslog:tst:1 true
Following items have been found on the system:
| Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| multi-user.target | basic.target | -.mount | sysinit.target | systemd-sysusers.service | systemd-sysctl.service | sys-fs-fuse-connections.mount | local-fs.target | boot-efi.mount | boot.mount | systemd-remount-fs.service | ostree-remount.service | ldconfig.service | systemd-repart.service | systemd-tmpfiles-setup.service | sys-kernel-debug.mount | systemd-udevd.service | selinux-autorelabel-mark.service | cryptsetup.target | systemd-pcrphase-sysinit.service | dev-hugepages.mount | iscsi-onboot.service | systemd-journal-flush.service | systemd-ask-password-console.path | swap.target | dev-mapper-rhel\x2dswap.swap | systemd-tmpfiles-setup-dev.service | dev-mqueue.mount | lvm2-lvmpolld.socket | multipathd.service | sys-kernel-config.mount | systemd-boot-system-token.service | systemd-random-seed.service | systemd-journal-catalog-update.service | systemd-udev-trigger.service | systemd-hwdb-update.service | plymouth-start.service | dracut-shutdown.service | systemd-update-done.service | systemd-pcrphase.service | veritysetup.target | lvm2-monitor.service | integritysetup.target | systemd-network-generator.service | systemd-boot-update.service | systemd-journald.service | proc-sys-fs-binfmt_misc.automount | sys-kernel-tracing.mount | systemd-firstboot.service | systemd-binfmt.service | systemd-modules-load.service | systemd-machine-id-commit.service | plymouth-read-write.service | kmod-static-nodes.service | systemd-update-utmp.service | nis-domainname.service | slices.target | -.slice | system.slice | microcode.service | low-memory-monitor.service | timers.target | systemd-tmpfiles-clean.timer | mlocate-updatedb.timer | logrotate.timer | dnf-makecache.timer | sockets.target | dbus.socket | multipathd.socket | iscsiuio.socket | avahi-daemon.socket | sssd-kcm.socket | systemd-udevd-kernel.socket | dm-event.socket | systemd-initctl.socket | cups.socket | systemd-coredump.socket | systemd-journald.socket | iscsid.socket | systemd-journald-dev-log.socket | systemd-udevd-control.socket | paths.target | ostree-readonly-sysroot-migration.service | mcelog.service | plymouth-quit.service | ModemManager.service | libstoragemgmt.service | smartd.service | plymouth-quit-wait.service | NetworkManager.service | irqbalance.service | avahi-daemon.service | remote-fs.target | iscsi.service | insights-client-boot.service | sshd.service | chronyd.service | cups.service | getty.target | getty@tty1.service | tuned.service | auditd.service | kdump.service | vmtoolsd.service | crond.service | firewalld.service | systemd-ask-password-wall.path | rsyslog.service | cups.path | systemd-logind.service | rhsmcertd.service | atd.service | sssd.service | systemd-update-utmp-runlevel.service | mdmonitor.service | systemd-user-sessions.service |
systemd test oval:ssg-test_multi_user_wants_rsyslog_socket:tst:1 false
Following items have been found on the system:
| Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| multi-user.target | basic.target | -.mount | sysinit.target | systemd-sysusers.service | systemd-sysctl.service | sys-fs-fuse-connections.mount | local-fs.target | boot-efi.mount | boot.mount | systemd-remount-fs.service | ostree-remount.service | ldconfig.service | systemd-repart.service | systemd-tmpfiles-setup.service | sys-kernel-debug.mount | systemd-udevd.service | selinux-autorelabel-mark.service | cryptsetup.target | systemd-pcrphase-sysinit.service | dev-hugepages.mount | iscsi-onboot.service | systemd-journal-flush.service | systemd-ask-password-console.path | swap.target | dev-mapper-rhel\x2dswap.swap | systemd-tmpfiles-setup-dev.service | dev-mqueue.mount | lvm2-lvmpolld.socket | multipathd.service | sys-kernel-config.mount | systemd-boot-system-token.service | systemd-random-seed.service | systemd-journal-catalog-update.service | systemd-udev-trigger.service | systemd-hwdb-update.service | plymouth-start.service | dracut-shutdown.service | systemd-update-done.service | systemd-pcrphase.service | veritysetup.target | lvm2-monitor.service | integritysetup.target | systemd-network-generator.service | systemd-boot-update.service | systemd-journald.service | proc-sys-fs-binfmt_misc.automount | sys-kernel-tracing.mount | systemd-firstboot.service | systemd-binfmt.service | systemd-modules-load.service | systemd-machine-id-commit.service | plymouth-read-write.service | kmod-static-nodes.service | systemd-update-utmp.service | nis-domainname.service | slices.target | -.slice | system.slice | microcode.service | low-memory-monitor.service | timers.target | systemd-tmpfiles-clean.timer | mlocate-updatedb.timer | logrotate.timer | dnf-makecache.timer | sockets.target | dbus.socket | multipathd.socket | iscsiuio.socket | avahi-daemon.socket | sssd-kcm.socket | systemd-udevd-kernel.socket | dm-event.socket | systemd-initctl.socket | cups.socket | systemd-coredump.socket | systemd-journald.socket | iscsid.socket | systemd-journald-dev-log.socket | systemd-udevd-control.socket | paths.target | ostree-readonly-sysroot-migration.service | mcelog.service | plymouth-quit.service | ModemManager.service | libstoragemgmt.service | smartd.service | plymouth-quit-wait.service | NetworkManager.service | irqbalance.service | avahi-daemon.service | remote-fs.target | iscsi.service | insights-client-boot.service | sshd.service | chronyd.service | cups.service | getty.target | getty@tty1.service | tuned.service | auditd.service | kdump.service | vmtoolsd.service | crond.service | firewalld.service | systemd-ask-password-wall.path | rsyslog.service | cups.path | systemd-logind.service | rhsmcertd.service | atd.service | sssd.service | systemd-update-utmp-runlevel.service | mdmonitor.service | systemd-user-sessions.service |
Verify firewalld Enabled
| Rule ID | xccdf_org.ssgproject.content_rule_service_firewalld_enabled |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_firewalld_enabled:def:1 |
| Time | 2023-07-10T14:10:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-90833-5 References: 11, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, 3.1.3, 3.4.7, CCI-000366, CCI-000382, CCI-002314, 4.3.4.3.2, 4.3.4.3.3, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, CIP-003-8 R4, CIP-003-8 R5, CIP-004-6 R3, AC-4, CM-7(b), CA-3(5), SC-7(21), CM-6(a), PR.IP-1, FMT_SMF_EXT.1, SRG-OS-000096-GPOS-00050, SRG-OS-000297-GPOS-00115, SRG-OS-000480-GPOS-00227, SRG-OS-000480-GPOS-00231, SRG-OS-000480-GPOS-00232, 3.4.1.2 |
| Description |
The firewalld service can be enabled with the following command:
$ sudo systemctl enable firewalld.service |
| Rationale | Access control methods provide the ability to enhance system security posture
by restricting services and known good IP addresses and address ranges. This
prevents connections from unknown hosts and protocols. |
package firewalld is installed oval:ssg-test_service_firewalld_package_firewalld_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| firewalld | noarch | (none) | 1.el9 | 1.2.1 | 0:1.2.1-1.el9 | 199e2f91fd431d51 | firewalld-0:1.2.1-1.el9.noarch |
Test that the firewalld service is running oval:ssg-test_service_running_firewalld:tst:1 true
Following items have been found on the system:
| Unit | Property | Value |
|---|---|---|
| firewalld.service | ActiveState | active |
systemd test oval:ssg-test_multi_user_wants_firewalld:tst:1 true
Following items have been found on the system:
| Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| multi-user.target | basic.target | -.mount | sysinit.target | systemd-sysusers.service | systemd-sysctl.service | sys-fs-fuse-connections.mount | local-fs.target | boot-efi.mount | boot.mount | systemd-remount-fs.service | ostree-remount.service | ldconfig.service | systemd-repart.service | systemd-tmpfiles-setup.service | sys-kernel-debug.mount | systemd-udevd.service | selinux-autorelabel-mark.service | cryptsetup.target | systemd-pcrphase-sysinit.service | dev-hugepages.mount | iscsi-onboot.service | systemd-journal-flush.service | systemd-ask-password-console.path | swap.target | dev-mapper-rhel\x2dswap.swap | systemd-tmpfiles-setup-dev.service | dev-mqueue.mount | lvm2-lvmpolld.socket | multipathd.service | sys-kernel-config.mount | systemd-boot-system-token.service | systemd-random-seed.service | systemd-journal-catalog-update.service | systemd-udev-trigger.service | systemd-hwdb-update.service | plymouth-start.service | dracut-shutdown.service | systemd-update-done.service | systemd-pcrphase.service | veritysetup.target | lvm2-monitor.service | integritysetup.target | systemd-network-generator.service | systemd-boot-update.service | systemd-journald.service | proc-sys-fs-binfmt_misc.automount | sys-kernel-tracing.mount | systemd-firstboot.service | systemd-binfmt.service | systemd-modules-load.service | systemd-machine-id-commit.service | plymouth-read-write.service | kmod-static-nodes.service | systemd-update-utmp.service | nis-domainname.service | slices.target | -.slice | system.slice | microcode.service | low-memory-monitor.service | timers.target | systemd-tmpfiles-clean.timer | mlocate-updatedb.timer | logrotate.timer | dnf-makecache.timer | sockets.target | dbus.socket | multipathd.socket | iscsiuio.socket | avahi-daemon.socket | sssd-kcm.socket | systemd-udevd-kernel.socket | dm-event.socket | systemd-initctl.socket | cups.socket | systemd-coredump.socket | systemd-journald.socket | iscsid.socket | systemd-journald-dev-log.socket | systemd-udevd-control.socket | paths.target | ostree-readonly-sysroot-migration.service | mcelog.service | plymouth-quit.service | ModemManager.service | libstoragemgmt.service | smartd.service | plymouth-quit-wait.service | NetworkManager.service | irqbalance.service | avahi-daemon.service | remote-fs.target | iscsi.service | insights-client-boot.service | sshd.service | chronyd.service | cups.service | getty.target | getty@tty1.service | tuned.service | auditd.service | kdump.service | vmtoolsd.service | crond.service | firewalld.service | systemd-ask-password-wall.path | rsyslog.service | cups.path | systemd-logind.service | rhsmcertd.service | atd.service | sssd.service | systemd-update-utmp-runlevel.service | mdmonitor.service | systemd-user-sessions.service |
systemd test oval:ssg-test_multi_user_wants_firewalld_socket:tst:1 false
Following items have been found on the system:
| Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| multi-user.target | basic.target | -.mount | sysinit.target | systemd-sysusers.service | systemd-sysctl.service | sys-fs-fuse-connections.mount | local-fs.target | boot-efi.mount | boot.mount | systemd-remount-fs.service | ostree-remount.service | ldconfig.service | systemd-repart.service | systemd-tmpfiles-setup.service | sys-kernel-debug.mount | systemd-udevd.service | selinux-autorelabel-mark.service | cryptsetup.target | systemd-pcrphase-sysinit.service | dev-hugepages.mount | iscsi-onboot.service | systemd-journal-flush.service | systemd-ask-password-console.path | swap.target | dev-mapper-rhel\x2dswap.swap | systemd-tmpfiles-setup-dev.service | dev-mqueue.mount | lvm2-lvmpolld.socket | multipathd.service | sys-kernel-config.mount | systemd-boot-system-token.service | systemd-random-seed.service | systemd-journal-catalog-update.service | systemd-udev-trigger.service | systemd-hwdb-update.service | plymouth-start.service | dracut-shutdown.service | systemd-update-done.service | systemd-pcrphase.service | veritysetup.target | lvm2-monitor.service | integritysetup.target | systemd-network-generator.service | systemd-boot-update.service | systemd-journald.service | proc-sys-fs-binfmt_misc.automount | sys-kernel-tracing.mount | systemd-firstboot.service | systemd-binfmt.service | systemd-modules-load.service | systemd-machine-id-commit.service | plymouth-read-write.service | kmod-static-nodes.service | systemd-update-utmp.service | nis-domainname.service | slices.target | -.slice | system.slice | microcode.service | low-memory-monitor.service | timers.target | systemd-tmpfiles-clean.timer | mlocate-updatedb.timer | logrotate.timer | dnf-makecache.timer | sockets.target | dbus.socket | multipathd.socket | iscsiuio.socket | avahi-daemon.socket | sssd-kcm.socket | systemd-udevd-kernel.socket | dm-event.socket | systemd-initctl.socket | cups.socket | systemd-coredump.socket | systemd-journald.socket | iscsid.socket | systemd-journald-dev-log.socket | systemd-udevd-control.socket | paths.target | ostree-readonly-sysroot-migration.service | mcelog.service | plymouth-quit.service | ModemManager.service | libstoragemgmt.service | smartd.service | plymouth-quit-wait.service | NetworkManager.service | irqbalance.service | avahi-daemon.service | remote-fs.target | iscsi.service | insights-client-boot.service | sshd.service | chronyd.service | cups.service | getty.target | getty@tty1.service | tuned.service | auditd.service | kdump.service | vmtoolsd.service | crond.service | firewalld.service | systemd-ask-password-wall.path | rsyslog.service | cups.path | systemd-logind.service | rhsmcertd.service | atd.service | sssd.service | systemd-update-utmp-runlevel.service | mdmonitor.service | systemd-user-sessions.service |
Set Default firewalld Zone for Incoming Packets
| Rule ID | xccdf_org.ssgproject.content_rule_set_firewalld_default_zone |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-set_firewalld_default_zone:def:1 |
| Time | 2023-07-10T14:10:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84023-1 References: 11, 14, 3, 9, 5.10.1, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 3.1.3, 3.4.7, 3.13.6, CCI-000366, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, 1416, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CA-3(5), CM-7(b), SC-7(23), CM-6(a), PR.IP-1, PR.PT-3, FMT_MOF_EXT.1, Req-1.4, SRG-OS-000480-GPOS-00227, SRG-OS-000480-VMM-002000, 3.4.2.1 |
| Description | To set the default zone to drop for
the built-in default zone which processes incoming IPv4 and IPv6 packets,
modify the following line in
/etc/firewalld/firewalld.conf to be:
DefaultZone=drop |
| Rationale | In firewalld the default zone is applied only after all
the applicable rules in the table are examined for a match. Setting the
default zone to drop implements proper design for a firewall, i.e.
any packets which are not explicitly permitted should not be
accepted. |
| Warnings | warning
To prevent denying any access to the system, automatic remediation
of this control is not available. Remediation must be automated as
a component of machine provisioning, or followed manually as outlined
above. |
Check /etc/firewalld/firewalld.conf DefaultZone for drop oval:ssg-test_firewalld_input_drop:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_firewalld_input_drop:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/firewalld/firewalld.conf | ^DefaultZone=drop$ | 1 |
Set Default iptables Policy for Incoming Packets
| Rule ID | xccdf_org.ssgproject.content_rule_set_iptables_default_rule |
| Result | notchecked |
| Multi-check rule | no |
| Time | 2023-07-10T14:10:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-85969-4 References: 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CA-3(5), CM-7(b), SC-7(23), CM-6(a), PR.IP-1, PR.PT-3 |
| Description | To set the default policy to DROP (instead of ACCEPT) for
the built-in INPUT chain which processes incoming packets,
add or correct the following line in
/etc/sysconfig/iptables:
:INPUT DROP [0:0] |
| Rationale | In iptables the default policy is applied only after all
the applicable rules in the table are examined for a match. Setting the
default policy to DROP implements proper design for a firewall, i.e.
any packets which are not explicitly permitted should not be
accepted. |
Set Default iptables Policy for Forwarded Packets
| Rule ID | xccdf_org.ssgproject.content_rule_set_iptables_default_rule_forward |
| Result | notchecked |
| Multi-check rule | no |
| Time | 2023-07-10T14:10:29+05:00 |
| Severity | medium |
| Identifiers and References | References: 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CA-3(5), CM-7(b), SC-7(23), CM-6(a), PR.IP-1, PR.PT-3 |
| Description | To set the default policy to DROP (instead of ACCEPT) for
the built-in FORWARD chain which processes packets that will be forwarded from
one interface to another,
add or correct the following line in
/etc/sysconfig/iptables:
:FORWARD DROP [0:0] |
| Rationale | In iptables, the default policy is applied only after all
the applicable rules in the table are examined for a match. Setting the
default policy to DROP implements proper design for a firewall, i.e.
any packets which are not explicitly permitted should not be
accepted. |
Configure Accepting Router Advertisements on All IPv6 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_ra |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv6_conf_all_accept_ra:def:1 |
| Time | 2023-07-10T14:10:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84120-5 References: 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 3.1.20, CCI-000366, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, 3.3.9 |
| Description | To set the runtime status of the net.ipv6.conf.all.accept_ra kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.accept_ra=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv6.conf.all.accept_ra = 0 |
| Rationale | An illicit router advertisement message could result in a man-in-the-middle attack. |
net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv6_conf_all_disable_ipv6_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 |
kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1 oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1 false
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv6.conf.all.disable_ipv6 | 0 |
net.ipv6.conf.all.accept_ra static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_accept_ra:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv6.conf.all.accept_ra[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.accept_ra static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_accept_ra:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.accept_ra[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.accept_ra static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_accept_ra:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.accept_ra[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.accept_ra static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_accept_ra:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.accept_ra[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.accept_ra static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv6_conf_all_accept_ra_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_accept_ra:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_accept_ra:obj:1 |
kernel runtime parameter net.ipv6.conf.all.accept_ra set to the appropriate value oval:ssg-test_sysctl_net_ipv6_conf_all_accept_ra_runtime:tst:1 false
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv6.conf.all.accept_ra | 1 |
Disable Accepting ICMP Redirects for All IPv6 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_redirects |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv6_conf_all_accept_redirects:def:1 |
| Time | 2023-07-10T14:10:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84125-4 References: BP28(R22), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 3.1.20, CCI-000366, CCI-001551, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), CM-6(b), CM-6.1(iv), PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, 3.3.2 |
| Description | To set the runtime status of the net.ipv6.conf.all.accept_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.accept_redirects=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv6.conf.all.accept_redirects = 0 |
| Rationale | An illicit ICMP redirect message could result in a man-in-the-middle attack. |
net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv6_conf_all_disable_ipv6_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 |
kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1 oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1 false
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv6.conf.all.disable_ipv6 | 0 |
net.ipv6.conf.all.accept_redirects static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_accept_redirects_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_accept_redirects:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv6.conf.all.accept_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.accept_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_accept_redirects_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_accept_redirects:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.accept_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.accept_redirects static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_accept_redirects_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_accept_redirects:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.accept_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.accept_redirects static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_accept_redirects_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_accept_redirects:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.accept_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.accept_redirects static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_accept_redirects_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv6_conf_all_accept_redirects_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_accept_redirects:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_accept_redirects:obj:1 |
kernel runtime parameter net.ipv6.conf.all.accept_redirects set to the appropriate value oval:ssg-test_sysctl_net_ipv6_conf_all_accept_redirects_runtime:tst:1 false
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv6.conf.all.accept_redirects | 1 |
Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv6 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_accept_source_route |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv6_conf_all_accept_source_route:def:1 |
| Time | 2023-07-10T14:10:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84131-2 References: BP28(R22), 1, 12, 13, 14, 15, 16, 18, 4, 6, 8, 9, APO01.06, APO13.01, DSS01.05, DSS03.01, DSS05.02, DSS05.04, DSS05.07, DSS06.02, 3.1.20, CCI-000366, 4.2.3.4, 4.3.3.4, 4.4.3.3, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-7(a), CM-7(b), CM-6(a), DE.AE-1, ID.AM-3, PR.AC-5, PR.DS-5, PR.PT-4, SRG-OS-000480-GPOS-00227, 3.3.1 |
| Description | To set the runtime status of the net.ipv6.conf.all.accept_source_route kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.accept_source_route=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv6.conf.all.accept_source_route = 0 |
| Rationale | Source-routed packets allow the source of the packet to suggest routers
forward the packet along a different path than configured on the router, which can
be used to bypass network security measures. This requirement applies only to the
forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and
the system is functioning as a router.
Accepting source-routed packets in the IPv6 protocol has few legitimate uses. It should be disabled unless it is absolutely required. |
net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv6_conf_all_disable_ipv6_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 |
kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1 oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1 false
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv6.conf.all.disable_ipv6 | 0 |
net.ipv6.conf.all.accept_source_route static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_accept_source_route_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_accept_source_route:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv6.conf.all.accept_source_route[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.accept_source_route static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_accept_source_route_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_accept_source_route:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.accept_source_route[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.accept_source_route static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_accept_source_route_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_accept_source_route:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.accept_source_route[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.accept_source_route static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_accept_source_route_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_accept_source_route:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.accept_source_route[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.accept_source_route static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_accept_source_route_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv6_conf_all_accept_source_route_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_accept_source_route:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_accept_source_route:obj:1 |
kernel runtime parameter net.ipv6.conf.all.accept_source_route set to the appropriate value oval:ssg-test_sysctl_net_ipv6_conf_all_accept_source_route_runtime:tst:1 true
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv6.conf.all.accept_source_route | 0 |
Disable Kernel Parameter for IPv6 Forwarding
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_all_forwarding |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv6_conf_all_forwarding:def:1 |
| Time | 2023-07-10T14:10:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84114-8 References: 1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS05.02, DSS05.05, DSS05.07, DSS06.06, CCI-000366, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), CM-6(b), CM-6.1(iv), DE.CM-1, PR.DS-4, PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, 3.2.1 |
| Description | To set the runtime status of the net.ipv6.conf.all.forwarding kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.all.forwarding=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv6.conf.all.forwarding = 0 |
| Rationale | IP forwarding permits the kernel to forward packets from one network
interface to another. The ability to forward packets between two networks is
only appropriate for systems acting as routers. |
net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv6_conf_all_disable_ipv6_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 |
kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1 oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1 false
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv6.conf.all.disable_ipv6 | 0 |
net.ipv6.conf.all.forwarding static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_forwarding_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_forwarding:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv6.conf.all.forwarding[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.forwarding static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_forwarding_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_forwarding:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.forwarding[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.forwarding static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_forwarding_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_forwarding:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.forwarding[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.forwarding static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_forwarding_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_forwarding:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.forwarding[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.forwarding static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_forwarding_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv6_conf_all_forwarding_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_forwarding:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_forwarding:obj:1 |
kernel runtime parameter net.ipv6.conf.all.forwarding set to the appropriate value oval:ssg-test_sysctl_net_ipv6_conf_all_forwarding_runtime:tst:1 true
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv6.conf.all.forwarding | 0 |
Disable Accepting Router Advertisements on all IPv6 Interfaces by Default
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_ra |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv6_conf_default_accept_ra:def:1 |
| Time | 2023-07-10T14:10:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84124-7 References: 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 3.1.20, CCI-000366, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, 3.3.9 |
| Description | To set the runtime status of the net.ipv6.conf.default.accept_ra kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.accept_ra=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv6.conf.default.accept_ra = 0 |
| Rationale | An illicit router advertisement message could result in a man-in-the-middle attack. |
net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv6_conf_all_disable_ipv6_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 |
kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1 oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1 false
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv6.conf.all.disable_ipv6 | 0 |
net.ipv6.conf.default.accept_ra static configuration oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_default_accept_ra:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.default.accept_ra static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_default_accept_ra:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.default.accept_ra static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_default_accept_ra:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.default.accept_ra static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_default_accept_ra:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.default.accept_ra[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.default.accept_ra static configuration oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv6_conf_default_accept_ra_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_default_accept_ra:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_default_accept_ra:obj:1 |
kernel runtime parameter net.ipv6.conf.default.accept_ra set to the appropriate value oval:ssg-test_sysctl_net_ipv6_conf_default_accept_ra_runtime:tst:1 false
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv6.conf.default.accept_ra | 1 |
Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv6 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_redirects |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv6_conf_default_accept_redirects:def:1 |
| Time | 2023-07-10T14:10:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84113-0 References: BP28(R22), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 3.1.20, CCI-000366, CCI-001551, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, 3.3.2 |
| Description | To set the runtime status of the net.ipv6.conf.default.accept_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.accept_redirects=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv6.conf.default.accept_redirects = 0 |
| Rationale | An illicit ICMP redirect message could result in a man-in-the-middle attack. |
net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv6_conf_all_disable_ipv6_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 |
kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1 oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1 false
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv6.conf.all.disable_ipv6 | 0 |
net.ipv6.conf.default.accept_redirects static configuration oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_default_accept_redirects:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_default_accept_redirects:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.default.accept_redirects static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_default_accept_redirects:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.default.accept_redirects static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_default_accept_redirects:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.default.accept_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.default.accept_redirects static configuration oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv6_conf_default_accept_redirects_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_default_accept_redirects:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_default_accept_redirects:obj:1 |
kernel runtime parameter net.ipv6.conf.default.accept_redirects set to the appropriate value oval:ssg-test_sysctl_net_ipv6_conf_default_accept_redirects_runtime:tst:1 false
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv6.conf.default.accept_redirects | 1 |
Disable Kernel Parameter for Accepting Source-Routed Packets on IPv6 Interfaces by Default
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv6_conf_default_accept_source_route |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv6_conf_default_accept_source_route:def:1 |
| Time | 2023-07-10T14:10:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84130-4 References: BP28(R22), 1, 12, 13, 14, 15, 16, 18, 4, 6, 8, 9, APO01.06, APO13.01, DSS01.05, DSS03.01, DSS05.02, DSS05.04, DSS05.07, DSS06.02, 3.1.20, CCI-000366, 4.2.3.4, 4.3.3.4, 4.4.3.3, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-7(a), CM-7(b), CM-6(a), CM-6(b), CM-6.1(iv), DE.AE-1, ID.AM-3, PR.AC-5, PR.DS-5, PR.PT-4, Req-1.4.3, SRG-OS-000480-GPOS-00227, 3.3.1 |
| Description | To set the runtime status of the net.ipv6.conf.default.accept_source_route kernel parameter, run the following command: $ sudo sysctl -w net.ipv6.conf.default.accept_source_route=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv6.conf.default.accept_source_route = 0 |
| Rationale | Source-routed packets allow the source of the packet to suggest routers
forward the packet along a different path than configured on the router, which can
be used to bypass network security measures. This requirement applies only to the
forwarding of source-routerd traffic, such as when IPv6 forwarding is enabled and
the system is functioning as a router.
Accepting source-routed packets in the IPv6 protocol has few legitimate
uses. It should be disabled unless it is absolutely required. |
net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.all.disable_ipv6[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.all.disable_ipv6 static configuration oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv6_conf_all_disable_ipv6_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_all_disable_ipv6:obj:1 |
kernel runtime parameter net.ipv6.conf.all.disable_ipv6 set to 1 oval:ssg-test_sysctl_net_ipv6_conf_all_disable_ipv6_runtime:tst:1 false
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv6.conf.all.disable_ipv6 | 0 |
net.ipv6.conf.default.accept_source_route static configuration oval:ssg-test_sysctl_net_ipv6_conf_default_accept_source_route_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv6_conf_default_accept_source_route:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv6.conf.default.accept_source_route[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.default.accept_source_route static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_default_accept_source_route_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv6_conf_default_accept_source_route:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.default.accept_source_route[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.default.accept_source_route static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_default_accept_source_route_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv6_conf_default_accept_source_route:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.default.accept_source_route[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.default.accept_source_route static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv6_conf_default_accept_source_route_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv6_conf_default_accept_source_route:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv6.conf.default.accept_source_route[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv6.conf.default.accept_source_route static configuration oval:ssg-test_sysctl_net_ipv6_conf_default_accept_source_route_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv6_conf_default_accept_source_route_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv6_conf_default_accept_source_route:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv6_conf_default_accept_source_route:obj:1 |
kernel runtime parameter net.ipv6.conf.default.accept_source_route set to the appropriate value oval:ssg-test_sysctl_net_ipv6_conf_default_accept_source_route_runtime:tst:1 true
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv6.conf.default.accept_source_route | 0 |
Disable Accepting ICMP Redirects for All IPv4 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_redirects |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_all_accept_redirects:def:1 |
| Time | 2023-07-10T14:10:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84011-6 References: BP28(R22), 1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9, 5.10.1.1, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS05.02, DSS05.05, DSS05.07, DSS06.06, 3.1.20, CCI-000366, CCI-001503, CCI-001551, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), SC-7(a), DE.CM-1, PR.DS-4, PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, 3.3.2 |
| Description | To set the runtime status of the net.ipv4.conf.all.accept_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.accept_redirects=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.all.accept_redirects = 0 |
| Rationale | ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages modify the
host's route table and are unauthenticated. An illicit ICMP redirect
message could result in a man-in-the-middle attack.
This feature of the IPv4 protocol has few legitimate uses. It should be disabled unless absolutely required." |
net.ipv4.conf.all.accept_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_accept_redirects:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.all.accept_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_accept_redirects:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.all.accept_redirects static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_accept_redirects:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.all.accept_redirects static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_accept_redirects:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.all.accept_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.all.accept_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv4_conf_all_accept_redirects_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_accept_redirects:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_accept_redirects:obj:1 |
kernel runtime parameter net.ipv4.conf.all.accept_redirects set to the appropriate value oval:ssg-test_sysctl_net_ipv4_conf_all_accept_redirects_runtime:tst:1 false
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv4.conf.all.accept_redirects | 1 |
Disable Kernel Parameter for Accepting Source-Routed Packets on all IPv4 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_accept_source_route |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_all_accept_source_route:def:1 |
| Time | 2023-07-10T14:10:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84001-7 References: BP28(R22), 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 3.1.20, CCI-000366, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1, CM-7(a), CM-7(b), SC-5, CM-6(a), SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227, 3.3.1 |
| Description | To set the runtime status of the net.ipv4.conf.all.accept_source_route kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.accept_source_route=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.all.accept_source_route = 0 |
| Rationale | Source-routed packets allow the source of the packet to suggest routers
forward the packet along a different path than configured on the router,
which can be used to bypass network security measures. This requirement
applies only to the forwarding of source-routerd traffic, such as when IPv4
forwarding is enabled and the system is functioning as a router.
Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required. |
net.ipv4.conf.all.accept_source_route static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_accept_source_route:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.all.accept_source_route static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_accept_source_route:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.all.accept_source_route static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_accept_source_route:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.all.accept_source_route static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_accept_source_route:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.all.accept_source_route[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.all.accept_source_route static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv4_conf_all_accept_source_route_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_accept_source_route:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_accept_source_route:obj:1 |
kernel runtime parameter net.ipv4.conf.all.accept_source_route set to the appropriate value oval:ssg-test_sysctl_net_ipv4_conf_all_accept_source_route_runtime:tst:1 true
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv4.conf.all.accept_source_route | 0 |
Enable Kernel Parameter to Log Martian Packets on all IPv4 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_log_martians |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_all_log_martians:def:1 |
| Time | 2023-07-10T14:10:29+05:00 |
| Severity | unknown |
| Identifiers and References | Identifiers: CCE-84000-9 References: BP28(R22), 1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.04, DSS03.05, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.06, 3.1.20, CCI-000126, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.11.2.6, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), SC-5(3)(a), DE.CM-1, PR.AC-3, PR.DS-4, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227, 3.3.4 |
| Description | To set the runtime status of the net.ipv4.conf.all.log_martians kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.log_martians=1To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.all.log_martians = 1 |
| Rationale | The presence of "martian" packets (which have impossible addresses)
as well as spoofed packets, source-routed packets, and redirects could be a
sign of nefarious network activity. Logging these packets enables this activity
to be detected. |
net.ipv4.conf.all.log_martians static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_log_martians:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.all.log_martians static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_log_martians:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.all.log_martians static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_log_martians:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.all.log_martians static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_log_martians:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.all.log_martians[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.all.log_martians static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv4_conf_all_log_martians_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_log_martians:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_log_martians:obj:1 |
kernel runtime parameter net.ipv4.conf.all.log_martians set to the appropriate value oval:ssg-test_sysctl_net_ipv4_conf_all_log_martians_runtime:tst:1 false
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv4.conf.all.log_martians | 0 |
Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_rp_filter |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_all_rp_filter:def:1 |
| Time | 2023-07-10T14:10:30+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84008-2 References: BP28(R22), 1, 12, 13, 14, 15, 16, 18, 2, 4, 6, 7, 8, 9, APO01.06, APO13.01, BAI04.04, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.07, DSS06.02, 3.1.20, CCI-000366, CCI-001551, 4.2.3.4, 4.3.3.4, 4.4.3.3, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-7(a), CM-7(b), CM-6(a), SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.PT-4, Req-1.4.3, SRG-OS-000480-GPOS-00227, 3.3.7 |
| Description | To set the runtime status of the net.ipv4.conf.all.rp_filter kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.rp_filter=1To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.all.rp_filter = 1 |
| Rationale | Enabling reverse path filtering drops packets with source addresses
that should not have been able to be received on the interface they were
received on. It should not be used on systems which are routers for
complicated networks, but is helpful for end hosts and routers serving small
networks. |
net.ipv4.conf.all.rp_filter static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_rp_filter:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.all.rp_filter static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_rp_filter:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.all.rp_filter static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_rp_filter:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.all.rp_filter static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_rp_filter:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.all.rp_filter[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.all.rp_filter static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv4_conf_all_rp_filter_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_rp_filter:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_rp_filter:obj:1 |
kernel runtime parameter net.ipv4.conf.all.rp_filter set to 1 or 2 oval:ssg-test_sysctl_net_ipv4_conf_all_rp_filter_runtime:tst:1 false
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv4.conf.all.rp_filter | 0 |
Disable Kernel Parameter for Accepting Secure ICMP Redirects on all IPv4 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_secure_redirects |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_all_secure_redirects:def:1 |
| Time | 2023-07-10T14:10:30+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84016-5 References: BP28(R22), 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 3.1.20, CCI-001503, CCI-001551, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-7(a), CM-7(b), CM-6(a), SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, Req-1.4.3, SRG-OS-000480-GPOS-00227, 3.3.3 |
| Description | To set the runtime status of the net.ipv4.conf.all.secure_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.secure_redirects=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.all.secure_redirects = 0 |
| Rationale | Accepting "secure" ICMP redirects (from those gateways listed as
default gateways) has few legitimate uses. It should be disabled unless it is
absolutely required. |
net.ipv4.conf.all.secure_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_secure_redirects:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.all.secure_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_secure_redirects:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.all.secure_redirects static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_secure_redirects:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.all.secure_redirects static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_secure_redirects:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.all.secure_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.all.secure_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv4_conf_all_secure_redirects_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_secure_redirects:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_secure_redirects:obj:1 |
kernel runtime parameter net.ipv4.conf.all.secure_redirects set to the appropriate value oval:ssg-test_sysctl_net_ipv4_conf_all_secure_redirects_runtime:tst:1 false
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv4.conf.all.secure_redirects | 1 |
Disable Kernel Parameter for Accepting ICMP Redirects by Default on IPv4 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_redirects |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_default_accept_redirects:def:1 |
| Time | 2023-07-10T14:10:30+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84003-3 References: BP28(R22), 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9, 5.10.1.1, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 3.1.20, CCI-000366, CCI-001551, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-7(a), CM-7(b), CM-6(a), SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, Req-1.4.3, SRG-OS-000480-GPOS-00227, 3.3.2 |
| Description | To set the runtime status of the net.ipv4.conf.default.accept_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.accept_redirects=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.default.accept_redirects = 0 |
| Rationale | ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages modify the
host's route table and are unauthenticated. An illicit ICMP redirect
message could result in a man-in-the-middle attack.
This feature of the IPv4 protocol has few legitimate uses. It should be disabled unless absolutely required. |
net.ipv4.conf.default.accept_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_default_accept_redirects:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.default.accept_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_default_accept_redirects:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.default.accept_redirects static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_default_accept_redirects:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.default.accept_redirects static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_default_accept_redirects:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.default.accept_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.default.accept_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv4_conf_default_accept_redirects_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_default_accept_redirects:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_default_accept_redirects:obj:1 |
kernel runtime parameter net.ipv4.conf.default.accept_redirects set to the appropriate value oval:ssg-test_sysctl_net_ipv4_conf_default_accept_redirects_runtime:tst:1 false
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv4.conf.default.accept_redirects | 1 |
Disable Kernel Parameter for Accepting Source-Routed Packets on IPv4 Interfaces by Default
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_accept_source_route |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_default_accept_source_route:def:1 |
| Time | 2023-07-10T14:10:30+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84007-4 References: BP28(R22), 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9, 5.10.1.1, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 3.1.20, CCI-000366, CCI-001551, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1, CM-7(a), CM-7(b), SC-5, SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227, 3.3.1 |
| Description | To set the runtime status of the net.ipv4.conf.default.accept_source_route kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.accept_source_route=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.default.accept_source_route = 0 |
| Rationale | Source-routed packets allow the source of the packet to suggest routers
forward the packet along a different path than configured on the router,
which can be used to bypass network security measures.
Accepting source-routed packets in the IPv4 protocol has few legitimate uses. It should be disabled unless it is absolutely required, such as when IPv4 forwarding is enabled and the system is legitimately functioning as a router. |
net.ipv4.conf.default.accept_source_route static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_default_accept_source_route:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.default.accept_source_route static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_default_accept_source_route:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.default.accept_source_route static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_default_accept_source_route:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.default.accept_source_route static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_default_accept_source_route:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.default.accept_source_route[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.default.accept_source_route static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv4_conf_default_accept_source_route_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_default_accept_source_route:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_default_accept_source_route:obj:1 |
kernel runtime parameter net.ipv4.conf.default.accept_source_route set to the appropriate value oval:ssg-test_sysctl_net_ipv4_conf_default_accept_source_route_runtime:tst:1 true
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv4.conf.default.accept_source_route | 0 |
Enable Kernel Paremeter to Log Martian Packets on all IPv4 Interfaces by Default
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_log_martians |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_default_log_martians:def:1 |
| Time | 2023-07-10T14:10:30+05:00 |
| Severity | unknown |
| Identifiers and References | Identifiers: CCE-84014-0 References: 1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.04, DSS03.05, DSS05.02, DSS05.03, DSS05.05, DSS05.07, DSS06.06, 3.1.20, CCI-000126, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.11.2.6, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), SC-5(3)(a), DE.CM-1, PR.AC-3, PR.DS-4, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227, 3.3.4 |
| Description | To set the runtime status of the net.ipv4.conf.default.log_martians kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.log_martians=1To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.default.log_martians = 1 |
| Rationale | The presence of "martian" packets (which have impossible addresses)
as well as spoofed packets, source-routed packets, and redirects could be a
sign of nefarious network activity. Logging these packets enables this activity
to be detected. |
net.ipv4.conf.default.log_martians static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_default_log_martians:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.default.log_martians static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_default_log_martians:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.default.log_martians static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_default_log_martians:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.default.log_martians static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_default_log_martians:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.default.log_martians[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.default.log_martians static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv4_conf_default_log_martians_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_default_log_martians:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_default_log_martians:obj:1 |
kernel runtime parameter net.ipv4.conf.default.log_martians set to the appropriate value oval:ssg-test_sysctl_net_ipv4_conf_default_log_martians_runtime:tst:1 false
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv4.conf.default.log_martians | 0 |
Enable Kernel Parameter to Use Reverse Path Filtering on all IPv4 Interfaces by Default
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_rp_filter |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_default_rp_filter:def:1 |
| Time | 2023-07-10T14:10:30+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84009-0 References: BP28(R22), 1, 12, 13, 14, 15, 16, 18, 2, 4, 6, 7, 8, 9, APO01.06, APO13.01, BAI04.04, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.07, DSS06.02, 3.1.20, CCI-000366, 4.2.3.4, 4.3.3.4, 4.4.3.3, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-7(a), CM-7(b), CM-6(a), SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.PT-4, SRG-OS-000480-GPOS-00227, 3.3.7 |
| Description | To set the runtime status of the net.ipv4.conf.default.rp_filter kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.rp_filter=1To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.default.rp_filter = 1 |
| Rationale | Enabling reverse path filtering drops packets with source addresses
that should not have been able to be received on the interface they were
received on. It should not be used on systems which are routers for
complicated networks, but is helpful for end hosts and routers serving small
networks. |
net.ipv4.conf.default.rp_filter static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_default_rp_filter:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.default.rp_filter static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_default_rp_filter:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.default.rp_filter static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_default_rp_filter:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.default.rp_filter static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_default_rp_filter:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.default.rp_filter[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.default.rp_filter static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv4_conf_default_rp_filter_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_default_rp_filter:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_default_rp_filter:obj:1 |
kernel runtime parameter net.ipv4.conf.default.rp_filter set to the appropriate value oval:ssg-test_sysctl_net_ipv4_conf_default_rp_filter_runtime:tst:1 true
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv4.conf.default.rp_filter | 1 |
Configure Kernel Parameter for Accepting Secure Redirects By Default
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_secure_redirects |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_default_secure_redirects:def:1 |
| Time | 2023-07-10T14:10:30+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84019-9 References: BP28(R22), 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 3.1.20, CCI-001551, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1, CM-7(a), CM-7(b), SC-5, SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227, 3.3.3 |
| Description | To set the runtime status of the net.ipv4.conf.default.secure_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.secure_redirects=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.default.secure_redirects = 0 |
| Rationale | Accepting "secure" ICMP redirects (from those gateways listed as
default gateways) has few legitimate uses. It should be disabled unless it is
absolutely required. |
net.ipv4.conf.default.secure_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_default_secure_redirects:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.default.secure_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_default_secure_redirects:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.default.secure_redirects static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_default_secure_redirects:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.default.secure_redirects static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_default_secure_redirects:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.default.secure_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.default.secure_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv4_conf_default_secure_redirects_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_default_secure_redirects:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_default_secure_redirects:obj:1 |
kernel runtime parameter net.ipv4.conf.default.secure_redirects set to the appropriate value oval:ssg-test_sysctl_net_ipv4_conf_default_secure_redirects_runtime:tst:1 false
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv4.conf.default.secure_redirects | 1 |
Enable Kernel Parameter to Ignore ICMP Broadcast Echo Requests on IPv4 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_echo_ignore_broadcasts |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_icmp_echo_ignore_broadcasts:def:1 |
| Time | 2023-07-10T14:10:30+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84004-1 References: 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9, 5.10.1.1, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 3.1.20, CCI-000366, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1, CM-7(a), CM-7(b), SC-5, DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, Req-1.4.3, SRG-OS-000480-GPOS-00227, 3.3.5 |
| Description | To set the runtime status of the net.ipv4.icmp_echo_ignore_broadcasts kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.icmp_echo_ignore_broadcasts=1To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.icmp_echo_ignore_broadcasts = 1 |
| Rationale | Responding to broadcast (ICMP) echoes facilitates network mapping
and provides a vector for amplification attacks.
Ignoring ICMP echo requests (pings) sent to broadcast or multicast addresses makes the system slightly more difficult to enumerate on the network. |
net.ipv4.icmp_echo_ignore_broadcasts static configuration oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.icmp_echo_ignore_broadcasts static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.icmp_echo_ignore_broadcasts static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.icmp_echo_ignore_broadcasts static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.icmp_echo_ignore_broadcasts[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.icmp_echo_ignore_broadcasts static configuration oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_icmp_echo_ignore_broadcasts:obj:1 |
kernel runtime parameter net.ipv4.icmp_echo_ignore_broadcasts set to the appropriate value oval:ssg-test_sysctl_net_ipv4_icmp_echo_ignore_broadcasts_runtime:tst:1 true
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv4.icmp_echo_ignore_broadcasts | 1 |
Enable Kernel Parameter to Ignore Bogus ICMP Error Responses on IPv4 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_icmp_ignore_bogus_error_responses |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_icmp_ignore_bogus_error_responses:def:1 |
| Time | 2023-07-10T14:10:30+05:00 |
| Severity | unknown |
| Identifiers and References | Identifiers: CCE-84015-7 References: BP28(R22), 1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS05.02, DSS05.05, DSS05.07, DSS06.06, 3.1.20, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.9.1.2, CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1, CM-7(a), CM-7(b), SC-5, DE.CM-1, PR.DS-4, PR.IP-1, PR.PT-3, Req-1.4.3, SRG-OS-000480-GPOS-00227, 3.3.6 |
| Description | To set the runtime status of the net.ipv4.icmp_ignore_bogus_error_responses kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.icmp_ignore_bogus_error_responses=1To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.icmp_ignore_bogus_error_responses = 1 |
| Rationale | Ignoring bogus ICMP error responses reduces
log size, although some activity would not be logged. |
net.ipv4.icmp_ignore_bogus_error_responses static configuration oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.icmp_ignore_bogus_error_responses static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.icmp_ignore_bogus_error_responses static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.icmp_ignore_bogus_error_responses static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.icmp_ignore_bogus_error_responses[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.icmp_ignore_bogus_error_responses static configuration oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_icmp_ignore_bogus_error_responses:obj:1 |
kernel runtime parameter net.ipv4.icmp_ignore_bogus_error_responses set to the appropriate value oval:ssg-test_sysctl_net_ipv4_icmp_ignore_bogus_error_responses_runtime:tst:1 true
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv4.icmp_ignore_bogus_error_responses | 1 |
Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_all_send_redirects |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_all_send_redirects:def:1 |
| Time | 2023-07-10T14:10:30+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83997-7 References: BP28(R22), 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9, 5.10.1.1, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 3.1.20, CCI-000366, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1, CM-7(a), CM-7(b), SC-5, CM-6(a), SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227, 3.2.2 |
| Description | To set the runtime status of the net.ipv4.conf.all.send_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.all.send_redirects=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.all.send_redirects = 0 |
| Rationale | ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages contain information
from the system's route table possibly revealing portions of the network topology.
The ability to send ICMP redirects is only appropriate for systems acting as routers. |
net.ipv4.conf.all.send_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_all_send_redirects:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.all.send_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_all_send_redirects:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.all.send_redirects static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_all_send_redirects:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.all.send_redirects static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_all_send_redirects:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.all.send_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.all.send_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv4_conf_all_send_redirects_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_all_send_redirects:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_all_send_redirects:obj:1 |
kernel runtime parameter net.ipv4.conf.all.send_redirects set to 0 oval:ssg-test_sysctl_net_ipv4_conf_all_send_redirects_runtime:tst:1 false
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv4.conf.all.send_redirects | 1 |
Disable Kernel Parameter for Sending ICMP Redirects on all IPv4 Interfaces by Default
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_conf_default_send_redirects |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_conf_default_send_redirects:def:1 |
| Time | 2023-07-10T14:10:30+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83999-3 References: BP28(R22), 1, 11, 12, 13, 14, 15, 16, 18, 2, 3, 4, 6, 7, 8, 9, 5.10.1.1, APO01.06, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS01.05, DSS03.01, DSS03.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, 3.1.20, CCI-000366, 4.2.3.4, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1, CM-7(a), CM-7(b), SC-5, CM-6(a), SC-7(a), DE.AE-1, DE.CM-1, ID.AM-3, PR.AC-5, PR.DS-4, PR.DS-5, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227, 3.2.2 |
| Description | To set the runtime status of the net.ipv4.conf.default.send_redirects kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.conf.default.send_redirects=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.conf.default.send_redirects = 0 |
| Rationale | ICMP redirect messages are used by routers to inform hosts that a more
direct route exists for a particular destination. These messages contain information
from the system's route table possibly revealing portions of the network topology.
The ability to send ICMP redirects is only appropriate for systems acting as routers. |
net.ipv4.conf.default.send_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv4_conf_default_send_redirects:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.default.send_redirects static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_conf_default_send_redirects:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.default.send_redirects static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_conf_default_send_redirects:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.default.send_redirects static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_conf_default_send_redirects:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.conf.default.send_redirects[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.conf.default.send_redirects static configuration oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv4_conf_default_send_redirects_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_conf_default_send_redirects:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_conf_default_send_redirects:obj:1 |
kernel runtime parameter net.ipv4.conf.default.send_redirects set to 0 oval:ssg-test_sysctl_net_ipv4_conf_default_send_redirects_runtime:tst:1 false
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv4.conf.default.send_redirects | 1 |
Disable Kernel Parameter for IP Forwarding on IPv4 Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_net_ipv4_ip_forward |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_net_ipv4_ip_forward:def:1 |
| Time | 2023-07-10T14:10:30+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83998-5 References: BP28(R22), 1, 11, 12, 13, 14, 15, 16, 2, 3, 7, 8, 9, APO13.01, BAI04.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.03, DSS03.05, DSS05.02, DSS05.05, DSS05.07, DSS06.06, 3.1.20, CCI-000366, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 6.2, SR 7.1, SR 7.2, SR 7.6, A.12.1.2, A.12.1.3, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.17.2.1, A.9.1.2, CIP-007-3 R4, CIP-007-3 R4.1, CIP-007-3 R4.2, CIP-007-3 R5.1, CM-7(a), CM-7(b), SC-5, CM-6(a), SC-7(a), DE.CM-1, PR.DS-4, PR.IP-1, PR.PT-3, PR.PT-4, Req-1.3.1, Req-1.3.2, SRG-OS-000480-GPOS-00227, 3.2.1 |
| Description | To set the runtime status of the net.ipv4.ip_forward kernel parameter, run the following command: $ sudo sysctl -w net.ipv4.ip_forward=0To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: net.ipv4.ip_forward = 0 |
| Rationale | Routing protocol daemons are typically used on routers to exchange
network topology information with other routers. If this capability is used when
not required, system network information may be unnecessarily transmitted across
the network. |
| Warnings | warning
Certain technologies such as virtual machines, containers, etc. rely on IPv4 forwarding to enable and use networking.
Disabling IPv4 forwarding would cause those technologies to stop working. Therefore, this rule should not be used in
profiles or benchmarks that target usage of IPv4 forwarding. |
net.ipv4.ip_forward static configuration oval:ssg-test_sysctl_net_ipv4_ip_forward_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_net_ipv4_ip_forward:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*net.ipv4.ip_forward[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.ip_forward static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_ip_forward_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_net_ipv4_ip_forward:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.ip_forward[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.ip_forward static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_ip_forward_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_net_ipv4_ip_forward:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.ip_forward[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.ip_forward static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_net_ipv4_ip_forward_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_net_ipv4_ip_forward:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*net.ipv4.ip_forward[\s]*=[\s]*(.*)[\s]*$ | 1 |
net.ipv4.ip_forward static configuration oval:ssg-test_sysctl_net_ipv4_ip_forward_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_net_ipv4_ip_forward_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_net_ipv4_ip_forward:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_net_ipv4_ip_forward:obj:1 |
kernel runtime parameter net.ipv4.ip_forward set to 0 oval:ssg-test_sysctl_net_ipv4_ip_forward_runtime:tst:1 true
Following items have been found on the system:
| Name | Value |
|---|---|
| net.ipv4.ip_forward | 0 |
Install nftables Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_nftables_installed |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_nftables_installed:def:1 |
| Time | 2023-07-10T14:10:30+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-86378-7 References: 3.4.1.1 |
| Description | nftables provides a new in-kernel packet classification framework that is based on a
network-specific Virtual Machine (VM) and a new nft userspace command line tool.
nftables reuses the existing Netfilter subsystems such as the existing hook infrastructure,
the connection tracking system, NAT, userspace queuing and logging subsystem.
The nftables package can be installed with the following command:
$ sudo dnf install nftables |
| Rationale | nftables is a subsystem of the Linux kernel that can protect against threats
originating from within a corporate network to include malicious mobile code and poorly
configured software on a host. |
package nftables is installed oval:ssg-test_package_nftables_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| nftables | x86_64 | 1 | 10.el9_1 | 1.0.4 | 1:1.0.4-10.el9_1 | 199e2f91fd431d51 | nftables-1:1.0.4-10.el9_1.x86_64 |
Deactivate Wireless Network Interfaces
| Rule ID | xccdf_org.ssgproject.content_rule_wireless_disable_interfaces |
| Result | notapplicable |
| Multi-check rule | no |
| Time | 2023-07-10T14:10:30+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84066-0 References: 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, 3.1.16, CCI-000085, CCI-002418, CCI-002421, CCI-001443, CCI-001444, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, 1315, 1319, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, AC-18(a), AC-18(3), CM-7(a), CM-7(b), CM-6(a), MP-7, PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4, Req-1.3.3, SRG-OS-000299-GPOS-00117, SRG-OS-000300-GPOS-00118, SRG-OS-000424-GPOS-00188, SRG-OS-000481-GPOS-000481, 3.1.2 |
| Description | Deactivating wireless network interfaces should prevent normal usage of the wireless
capability.
Configure the system to disable all wireless network interfaces with the following command: $ sudo nmcli radio all off |
| Rationale | The use of wireless networking can introduce many different attack vectors into
the organization's network. Common attack vectors such as malicious association
and ad hoc networks will allow an attacker to spoof a wireless access point
(AP), allowing validated systems to connect to the malicious AP and enabling the
attacker to monitor and record network traffic. These malicious APs can also
serve to create a man-in-the-middle attack or be used to create a denial of
service to valid network resources. |
Verify Group Who Owns Backup group File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_group |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_backup_etc_group:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83928-2 References: CCI-002223, AC-6 (1), SRG-OS-000480-GPOS-00227, 6.1.4 |
| Description | To properly set the group owner of /etc/group-, run the command: $ sudo chgrp root /etc/group- |
| Rationale | The /etc/group- file is a backup file of /etc/group, and as such,
it contains information regarding groups that are configured on the system.
Protection of this file is important for system security. |
Testing group ownership of /etc/group- oval:ssg-test_file_groupowner_backup_etc_group_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_backup_etc_group_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/group- | oval:ssg-symlink_file_groupowner_backup_etc_group_uid_0:ste:1 | oval:ssg-state_file_groupowner_backup_etc_group_gid_0_0:ste:1 |
Verify Group Who Owns Backup gshadow File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_gshadow |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_backup_etc_gshadow:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83951-4 References: CCI-002223, AC-6 (1), SRG-OS-000480-GPOS-00227, 6.1.8 |
| Description | To properly set the group owner of /etc/gshadow-, run the command: $ sudo chgrp root /etc/gshadow- |
| Rationale | The /etc/gshadow- file is a backup of /etc/gshadow, and as such,
it contains group password hashes. Protection of this file is critical for system security. |
Testing group ownership of /etc/gshadow- oval:ssg-test_file_groupowner_backup_etc_gshadow_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_backup_etc_gshadow_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/gshadow- | oval:ssg-symlink_file_groupowner_backup_etc_gshadow_uid_0:ste:1 | oval:ssg-state_file_groupowner_backup_etc_gshadow_gid_0_0:ste:1 |
Verify Group Who Owns Backup passwd File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_passwd |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_backup_etc_passwd:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83933-2 References: CCI-002223, AC-6 (1), SRG-OS-000480-GPOS-00227, 6.1.2 |
| Description | To properly set the group owner of /etc/passwd-, run the command: $ sudo chgrp root /etc/passwd- |
| Rationale | The /etc/passwd- file is a backup file of /etc/passwd, and as such,
it contains information about the users that are configured on the system.
Protection of this file is critical for system security. |
Testing group ownership of /etc/passwd- oval:ssg-test_file_groupowner_backup_etc_passwd_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_backup_etc_passwd_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/passwd- | oval:ssg-symlink_file_groupowner_backup_etc_passwd_uid_0:ste:1 | oval:ssg-state_file_groupowner_backup_etc_passwd_gid_0_0:ste:1 |
Verify User Who Owns Backup shadow File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_backup_etc_shadow |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_backup_etc_shadow:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83938-1 References: SRG-OS-000480-GPOS-00227, 6.1.6 |
| Description | To properly set the group owner of /etc/shadow-, run the command: $ sudo chgrp root /etc/shadow- |
| Rationale | The /etc/shadow- file is a backup file of /etc/shadow, and as such,
it contains the list of local system accounts and password hashes.
Protection of this file is critical for system security. |
Testing group ownership of /etc/shadow- oval:ssg-test_file_groupowner_backup_etc_shadow_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_backup_etc_shadow_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/shadow- | oval:ssg-symlink_file_groupowner_backup_etc_shadow_uid_0:ste:1 | oval:ssg-state_file_groupowner_backup_etc_shadow_gid_0_0:ste:1 |
Verify Group Who Owns group File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_etc_group |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_etc_group:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83945-6 References: 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2.2, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-8.7.c, SRG-OS-000480-GPOS-00227, 6.1.3 |
| Description | To properly set the group owner of /etc/group, run the command: $ sudo chgrp root /etc/group |
| Rationale | The /etc/group file contains information regarding groups that are configured
on the system. Protection of this file is important for system security. |
Testing group ownership of /etc/group oval:ssg-test_file_groupowner_etc_group_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_etc_group_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/group | oval:ssg-symlink_file_groupowner_etc_group_uid_0:ste:1 | oval:ssg-state_file_groupowner_etc_group_gid_0_0:ste:1 |
Verify Group Who Owns gshadow File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_etc_gshadow |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_etc_gshadow:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83948-0 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, SRG-OS-000480-GPOS-00227, 6.1.7 |
| Description | To properly set the group owner of /etc/gshadow, run the command: $ sudo chgrp root /etc/gshadow |
| Rationale | The /etc/gshadow file contains group password hashes. Protection of this file
is critical for system security. |
Testing group ownership of /etc/gshadow oval:ssg-test_file_groupowner_etc_gshadow_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_etc_gshadow_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/gshadow | oval:ssg-symlink_file_groupowner_etc_gshadow_uid_0:ste:1 | oval:ssg-state_file_groupowner_etc_gshadow_gid_0_0:ste:1 |
Verify Group Who Owns passwd File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_etc_passwd |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_etc_passwd:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83950-6 References: 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2.2, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-8.7.c, SRG-OS-000480-GPOS-00227, 6.1.1 |
| Description | To properly set the group owner of /etc/passwd, run the command: $ sudo chgrp root /etc/passwd |
| Rationale | The /etc/passwd file contains information about the users that are configured on
the system. Protection of this file is critical for system security. |
Testing group ownership of /etc/passwd oval:ssg-test_file_groupowner_etc_passwd_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_etc_passwd_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/passwd | oval:ssg-symlink_file_groupowner_etc_passwd_uid_0:ste:1 | oval:ssg-state_file_groupowner_etc_passwd_gid_0_0:ste:1 |
Verify Group Who Owns shadow File
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_etc_shadow |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_etc_shadow:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83930-8 References: 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2.2, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-8.7.c, SRG-OS-000480-GPOS-00227, 6.1.5 |
| Description | To properly set the group owner of /etc/shadow, run the command: $ sudo chgrp root /etc/shadow |
| Rationale | The /etc/shadow file stores password hashes. Protection of this file is
critical for system security. |
Testing group ownership of /etc/shadow oval:ssg-test_file_groupowner_etc_shadow_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_etc_shadow_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/shadow | oval:ssg-symlink_file_groupowner_etc_shadow_uid_0:ste:1 | oval:ssg-state_file_groupowner_etc_shadow_gid_0_0:ste:1 |
Verify User Who Owns Backup group File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_backup_etc_group |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_backup_etc_group:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83944-9 References: CCI-002223, AC-6 (1), SRG-OS-000480-GPOS-00227, 6.1.4 |
| Description | To properly set the owner of /etc/group-, run the command: $ sudo chown root /etc/group- |
| Rationale | The /etc/group- file is a backup file of /etc/group, and as such,
it contains information regarding groups that are configured on the system.
Protection of this file is important for system security. |
Testing user ownership of /etc/group- oval:ssg-test_file_owner_backup_etc_group_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_backup_etc_group_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/group- | oval:ssg-symlink_file_owner_backup_etc_group_uid_0:ste:1 | oval:ssg-state_file_owner_backup_etc_group_uid_0_0:ste:1 |
Verify User Who Owns Backup gshadow File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_backup_etc_gshadow |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_backup_etc_gshadow:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83929-0 References: CCI-002223, AC-6 (1), SRG-OS-000480-GPOS-00227, 6.1.8 |
| Description | To properly set the owner of /etc/gshadow-, run the command: $ sudo chown root /etc/gshadow- |
| Rationale | The /etc/gshadow- file is a backup of /etc/gshadow, and as such,
it contains group password hashes. Protection of this file is critical for system security. |
Testing user ownership of /etc/gshadow- oval:ssg-test_file_owner_backup_etc_gshadow_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_backup_etc_gshadow_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/gshadow- | oval:ssg-symlink_file_owner_backup_etc_gshadow_uid_0:ste:1 | oval:ssg-state_file_owner_backup_etc_gshadow_uid_0_0:ste:1 |
Verify User Who Owns Backup passwd File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_backup_etc_passwd |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_backup_etc_passwd:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83947-2 References: CCI-002223, AC-6 (1), SRG-OS-000480-GPOS-00227, 6.1.2 |
| Description | To properly set the owner of /etc/passwd-, run the command: $ sudo chown root /etc/passwd- |
| Rationale | The /etc/passwd- file is a backup file of /etc/passwd, and as such,
it contains information about the users that are configured on the system.
Protection of this file is critical for system security. |
Testing user ownership of /etc/passwd- oval:ssg-test_file_owner_backup_etc_passwd_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_backup_etc_passwd_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/passwd- | oval:ssg-symlink_file_owner_backup_etc_passwd_uid_0:ste:1 | oval:ssg-state_file_owner_backup_etc_passwd_uid_0_0:ste:1 |
Verify Group Who Owns Backup shadow File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_backup_etc_shadow |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_backup_etc_shadow:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83949-8 References: CCI-002223, AC-6 (1), SRG-OS-000480-GPOS-00227, 6.1.6 |
| Description | To properly set the owner of /etc/shadow-, run the command: $ sudo chown root /etc/shadow- |
| Rationale | The /etc/shadow- file is a backup file of /etc/shadow, and as such,
it contains the list of local system accounts and password hashes.
Protection of this file is critical for system security. |
Testing user ownership of /etc/shadow- oval:ssg-test_file_owner_backup_etc_shadow_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_backup_etc_shadow_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/shadow- | oval:ssg-symlink_file_owner_backup_etc_shadow_uid_0:ste:1 | oval:ssg-state_file_owner_backup_etc_shadow_uid_0_0:ste:1 |
Verify User Who Owns group File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_etc_group |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_etc_group:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83925-8 References: 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2.2, APO01.06, DSS05.04, DSS05.07, DSS06.02, CCI-002223, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-8.7.c, SRG-OS-000480-GPOS-00227, 6.1.3 |
| Description | To properly set the owner of /etc/group, run the command: $ sudo chown root /etc/group |
| Rationale | The /etc/group file contains information regarding groups that are configured
on the system. Protection of this file is important for system security. |
Testing user ownership of /etc/group oval:ssg-test_file_owner_etc_group_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_etc_group_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/group | oval:ssg-symlink_file_owner_etc_group_uid_0:ste:1 | oval:ssg-state_file_owner_etc_group_uid_0_0:ste:1 |
Verify User Who Owns gshadow File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_etc_gshadow |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_etc_gshadow:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83924-1 References: BP28(R36), 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, CCI-002223, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, SRG-OS-000480-GPOS-00227, 6.1.7 |
| Description | To properly set the owner of /etc/gshadow, run the command: $ sudo chown root /etc/gshadow |
| Rationale | The /etc/gshadow file contains group password hashes. Protection of this file
is critical for system security. |
Testing user ownership of /etc/gshadow oval:ssg-test_file_owner_etc_gshadow_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_etc_gshadow_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/gshadow | oval:ssg-symlink_file_owner_etc_gshadow_uid_0:ste:1 | oval:ssg-state_file_owner_etc_gshadow_uid_0_0:ste:1 |
Verify User Who Owns passwd File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_etc_passwd |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_etc_passwd:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83943-1 References: 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2.2, APO01.06, DSS05.04, DSS05.07, DSS06.02, CCI-002223, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-8.7.c, SRG-OS-000480-GPOS-00227, 6.1.1 |
| Description | To properly set the owner of /etc/passwd, run the command: $ sudo chown root /etc/passwd |
| Rationale | The /etc/passwd file contains information about the users that are configured on
the system. Protection of this file is critical for system security. |
Testing user ownership of /etc/passwd oval:ssg-test_file_owner_etc_passwd_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_etc_passwd_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/passwd | oval:ssg-symlink_file_owner_etc_passwd_uid_0:ste:1 | oval:ssg-state_file_owner_etc_passwd_uid_0_0:ste:1 |
Verify User Who Owns shadow File
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_etc_shadow |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_etc_shadow:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83926-6 References: BP28(R36), 12, 13, 14, 15, 16, 18, 3, 5, 5.5.2.2, APO01.06, DSS05.04, DSS05.07, DSS06.02, CCI-002223, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, Req-8.7.c, SRG-OS-000480-GPOS-00227, 6.1.5 |
| Description | To properly set the owner of /etc/shadow, run the command: $ sudo chown root /etc/shadow |
| Rationale | The /etc/shadow file contains the list of local
system accounts and stores password hashes. Protection of this file is
critical for system security. Failure to give ownership of this file
to root provides the designated owner with access to sensitive information
which could weaken the system security posture. |
Testing user ownership of /etc/shadow oval:ssg-test_file_owner_etc_shadow_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_etc_shadow_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/shadow | oval:ssg-symlink_file_owner_etc_shadow_uid_0:ste:1 | oval:ssg-state_file_owner_etc_shadow_uid_0_0:ste:1 |
Verify that All World-Writable Directories Have Sticky Bits Set
| Rule ID | xccdf_org.ssgproject.content_rule_dir_perms_world_writable_sticky_bits |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-dir_perms_world_writable_sticky_bits:def:1 |
| Time | 2023-07-10T14:10:33+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83895-3 References: BP28(R40), 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, CCI-001090, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, SRG-OS-000138-GPOS-00069, 6.1.12 |
| Description | When the so-called 'sticky bit' is set on a directory,
only the owner of a given file may remove that file from the
directory. Without the sticky bit, any user with write access to a
directory may remove any file in the directory. Setting the sticky
bit prevents users from removing each other's files. In cases where
there is no reason for a directory to be world-writable, a better
solution is to remove that permission rather than to set the sticky
bit. However, if a directory is used by a particular application,
consult that application's documentation instead of blindly
changing modes.
To set the sticky bit on a world-writable directory DIR, run the following command: $ sudo chmod +t DIR |
| Rationale | Failing to set the sticky bit on public directories allows unauthorized
users to delete files in the directory structure.
The only authorized public directories are those temporary directories supplied with the system, or those designed to be temporary file repositories. The setting is normally reserved for directories used by the system, by users for temporary file storage (such as /tmp), and
for directories requiring global read/write access. |
all local world-writable directories have sticky bit set oval:ssg-test_dir_perms_world_writable_sticky_bits:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_only_local_directories:obj:1 of type file_object
| Behaviors | Path | Filename | Filter |
|---|---|---|---|
| no value | / | no value | oval:ssg-state_world_writable_and_not_sticky:ste:1 |
Ensure All Files Are Owned by a User
| Rule ID | xccdf_org.ssgproject.content_rule_no_files_unowned_by_user |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-no_files_unowned_by_user:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83896-1 References: 11, 12, 13, 14, 15, 16, 18, 3, 5, 9, APO01.06, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.03, DSS06.06, CCI-000366, CCI-002165, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 5.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), AC-6(1), PR.AC-4, PR.AC-6, PR.DS-5, PR.IP-1, PR.PT-3, SRG-OS-000480-GPOS-00227, 6.1.10 |
| Description | If any files are not owned by a user, then the
cause of their lack of ownership should be investigated.
Following this, the files should be deleted or assigned to an
appropriate user. The following command will discover and print
any files on local partitions which do not belong to a valid user:
$ df --local -P | awk {'if (NR!=1) print $6'} | sudo xargs -I '{}' find '{}' -xdev -nouser
To search all filesystems on a system including network mounted
filesystems the following command can be run manually for each partition:
$ sudo find PARTITION -xdev -nouser |
| Rationale | Unowned files do not directly imply a security problem, but they are generally
a sign that something is amiss. They may
be caused by an intruder, by incorrect software installation or
draft software removal, or by failure to remove all files belonging
to a deleted account. The files should be repaired so they
will not cause problems when accounts are created in the future,
and the cause should be discovered and addressed. |
| Warnings | warning
For this rule to evaluate centralized user accounts, getent must be working properly
so that running the command getent passwdreturns a list of all users in your organization. If using the System Security Services Daemon (SSSD), enumerate = truemust be configured in your organization's domain to return a complete list of users warning
Enabling this rule will result in slower scan times depending on the size of your organization
and number of centralized users. |
Check user ids on all files on the system oval:ssg-no_files_unowned_by_user_test:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-file_permissions_unowned_object:obj:1 of type file_object
| Behaviors | Path | Filename | Filter |
|---|---|---|---|
| no value | / | .* | oval:ssg-file_permissions_unowned_userid_list_match:ste:1 |
Disable Mounting of squashfs
| Rule ID | xccdf_org.ssgproject.content_rule_kernel_module_squashfs_disabled |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-kernel_module_squashfs_disabled:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | low |
| Identifiers and References | Identifiers: CCE-83855-7 References: 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 3.4.6, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, 1.1.1.1 |
| Description |
To configure the system to prevent the squashfs
kernel module from being loaded, add the following line to the file /etc/modprobe.d/squashfs.conf:
install squashfs /bin/trueThis effectively prevents usage of this uncommon filesystem. The squashfs filesystem type is a compressed read-only Linux
filesystem embedded in small footprint systems (similar to
cramfs). A squashfs image can be used without having
to first decompress the image. |
| Rationale | Removing support for unneeded filesystem types reduces the local attack
surface of the system. |
kernel module squashfs blacklisted oval:ssg-test_kernmod_squashfs_blacklisted:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_squashfs_blacklisted:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance | ||||||
|---|---|---|---|---|---|---|---|---|---|
| ^.*\.conf$ | ^blacklist\s+squashfs$ | 1 |
kernel module squashfs disabled oval:ssg-test_kernmod_squashfs_disabled:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_squashfs_disabled:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance | ||||||
|---|---|---|---|---|---|---|---|---|---|
| ^.*\.conf$ | ^\s*install\s+squashfs\s+(/bin/false|/bin/true)$ | 1 |
Disable Mounting of udf
| Rule ID | xccdf_org.ssgproject.content_rule_kernel_module_udf_disabled |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-kernel_module_udf_disabled:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | low |
| Identifiers and References | Identifiers: CCE-83852-4 References: 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 3.4.6, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, 1.1.1.2 |
| Description |
To configure the system to prevent the udf
kernel module from being loaded, add the following line to the file /etc/modprobe.d/udf.conf:
install udf /bin/trueThis effectively prevents usage of this uncommon filesystem. The udf filesystem type is the universal disk format
used to implement the ISO/IEC 13346 and ECMA-167 specifications.
This is an open vendor filesystem type for data storage on a broad
range of media. This filesystem type is neccessary to support
writing DVDs and newer optical disc formats. |
| Rationale | Removing support for unneeded filesystem types reduces the local
attack surface of the system. |
kernel module udf blacklisted oval:ssg-test_kernmod_udf_blacklisted:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_udf_blacklisted:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance | ||||||
|---|---|---|---|---|---|---|---|---|---|
| ^.*\.conf$ | ^blacklist\s+udf$ | 1 |
kernel module udf disabled oval:ssg-test_kernmod_udf_disabled:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_udf_disabled:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance | ||||||
|---|---|---|---|---|---|---|---|---|---|
| ^.*\.conf$ | ^\s*install\s+udf\s+(/bin/false|/bin/true)$ | 1 |
Disable Modprobe Loading of USB Storage Driver
| Rule ID | xccdf_org.ssgproject.content_rule_kernel_module_usb-storage_disabled |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-kernel_module_usb-storage_disabled:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83851-6 References: 1, 12, 15, 16, 5, APO13.01, DSS01.04, DSS05.03, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.1.21, CCI-000366, CCI-000778, CCI-001958, 164.308(a)(3)(i), 164.308(a)(3)(ii)(A), 164.310(d)(1), 164.310(d)(2), 164.312(a)(1), 164.312(a)(2)(iv), 164.312(b), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.6, A.11.2.6, A.13.1.1, A.13.2.1, A.18.1.4, A.6.2.1, A.6.2.2, A.7.1.1, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.2, A.9.4.3, CM-7(a), CM-7(b), CM-6(a), MP-7, PR.AC-1, PR.AC-3, PR.AC-6, PR.AC-7, SRG-OS-000114-GPOS-00059, SRG-OS-000378-GPOS-00163, SRG-OS-000480-GPOS-00227, 1.1.9 |
| Description | To prevent USB storage devices from being used, configure the kernel module loading system
to prevent automatic loading of the USB storage driver.
To configure the system to prevent the usb-storage
kernel module from being loaded, add the following line to the file /etc/modprobe.d/usb-storage.conf:
install usb-storage /bin/trueThis will prevent the modprobe program from loading the usb-storage
module, but will not prevent an administrator (or another program) from using the
insmod program to load the module manually. |
| Rationale | USB storage devices such as thumb drives can be used to introduce
malicious software. |
kernel module usb-storage blacklisted oval:ssg-test_kernmod_usb-storage_blacklisted:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_usb-storage_blacklisted:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance | ||||||
|---|---|---|---|---|---|---|---|---|---|
| ^.*\.conf$ | ^blacklist\s+usb-storage$ | 1 |
kernel module usb-storage disabled oval:ssg-test_kernmod_usb-storage_disabled:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_kernmod_usb-storage_disabled:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance | ||||||
|---|---|---|---|---|---|---|---|---|---|
| ^.*\.conf$ | ^\s*install\s+usb-storage\s+(/bin/false|/bin/true)$ | 1 |
Add nodev Option to /dev/shm
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nodev |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-mount_option_dev_shm_nodev:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83881-3 References: 11, 13, 14, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06, CCI-001764, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, 1.1.8.2 |
| Description | The nodev mount option can be used to prevent creation of device
files in /dev/shm. Legitimate character and block devices should
not exist within temporary directories like /dev/shm.
Add the nodev option to the fourth column of
/etc/fstab for the line which controls mounting of
/dev/shm. |
| Rationale | The only legitimate location for device files is the /dev directory
located on the root partition. The only exception to this is chroot jails. |
nodev on /dev/shm optional no oval:ssg-test_dev_shm_partition_nodev_optional_no:tst:1 true
Following items have been found on the system:
| Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
|---|---|---|---|---|---|---|---|---|---|---|---|
| /dev/shm | tmpfs | tmpfs | rw | seclabel | nosuid | nodev | inode64 | 468628 | 0 | 468628 |
/dev/shm exists oval:ssg-test_dev_shm_no_partition_nodev_optional_no:tst:1 true
Following items have been found on the system:
| Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
|---|---|---|---|---|---|---|---|---|---|---|---|
| /dev/shm | tmpfs | tmpfs | rw | seclabel | nosuid | nodev | inode64 | 468628 | 0 | 468628 |
Add noexec Option to /dev/shm
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_dev_shm_noexec |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-mount_option_dev_shm_noexec:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83857-3 References: 11, 13, 14, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06, CCI-001764, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, 1.1.8.3 |
| Description | The noexec mount option can be used to prevent binaries
from being executed out of /dev/shm.
It can be dangerous to allow the execution of binaries
from world-writable temporary storage directories such as /dev/shm.
Add the noexec option to the fourth column of
/etc/fstab for the line which controls mounting of
/dev/shm. |
| Rationale | Allowing users to execute binaries from world-writable directories
such as /dev/shm can expose the system to potential compromise. |
noexec on /dev/shm optional no oval:ssg-test_dev_shm_partition_noexec_optional_no:tst:1 false
Following items have been found on the system:
| Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
|---|---|---|---|---|---|---|---|---|---|---|---|
| /dev/shm | tmpfs | tmpfs | rw | seclabel | nosuid | nodev | inode64 | 468628 | 0 | 468628 |
/dev/shm exists oval:ssg-test_dev_shm_no_partition_noexec_optional_no:tst:1 true
Following items have been found on the system:
| Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
|---|---|---|---|---|---|---|---|---|---|---|---|
| /dev/shm | tmpfs | tmpfs | rw | seclabel | nosuid | nodev | inode64 | 468628 | 0 | 468628 |
Add nosuid Option to /dev/shm
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_dev_shm_nosuid |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-mount_option_dev_shm_nosuid:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83891-2 References: 11, 13, 14, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06, CCI-001764, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, 1.1.8.4 |
| Description | The nosuid mount option can be used to prevent execution
of setuid programs in /dev/shm. The SUID and SGID permissions should not
be required in these world-writable directories.
Add the nosuid option to the fourth column of
/etc/fstab for the line which controls mounting of
/dev/shm. |
| Rationale | The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from temporary storage partitions. |
nosuid on /dev/shm optional no oval:ssg-test_dev_shm_partition_nosuid_optional_no:tst:1 true
Following items have been found on the system:
| Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
|---|---|---|---|---|---|---|---|---|---|---|---|
| /dev/shm | tmpfs | tmpfs | rw | seclabel | nosuid | nodev | inode64 | 468628 | 0 | 468628 |
/dev/shm exists oval:ssg-test_dev_shm_no_partition_nosuid_optional_no:tst:1 true
Following items have been found on the system:
| Mount point | Device | Uuid | Fs type | Mount options | Mount options | Mount options | Mount options | Mount options | Total space | Space used | Space left |
|---|---|---|---|---|---|---|---|---|---|---|---|
| /dev/shm | tmpfs | tmpfs | rw | seclabel | nosuid | nodev | inode64 | 468628 | 0 | 468628 |
Add nodev Option to /home
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_home_nodev |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-mount_option_home_nodev:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | unknown |
| Identifiers and References | Identifiers: CCE-83871-4 References: BP28(R12), SRG-OS-000368-GPOS-00154, 1.1.7.2 |
| Description | The nodev mount option can be used to prevent device files from
being created in /home.
Legitimate character and block devices should exist only in
the /dev directory on the root partition or within chroot
jails built for system services.
Add the nodev option to the fourth column of
/etc/fstab for the line which controls mounting of
/home. |
| Rationale | The only legitimate location for device files is the /dev directory
located on the root partition. The only exception to this is chroot jails. |
nodev on /home optional yes oval:ssg-test_home_partition_nodev_optional_yes:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_home_partition_nodev_optional_yes:obj:1 of type partition_object
| Mount point |
|---|
| /home |
Add nosuid Option to /home
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_home_nosuid |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-mount_option_home_nosuid:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83894-6 References: BP28(R12), 11, 13, 14, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS05.06, DSS06.06, CCI-000366, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.11.2.9, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.8.2.1, A.8.2.2, A.8.2.3, A.8.3.1, A.8.3.3, A.9.1.2, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, SRG-OS-000480-GPOS-00227, 1.1.7.3 |
| Description | The nosuid mount option can be used to prevent
execution of setuid programs in /home. The SUID and SGID permissions
should not be required in these user data directories.
Add the nosuid option to the fourth column of
/etc/fstab for the line which controls mounting of
/home. |
| Rationale | The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from user home directory partitions. |
nosuid on /home optional yes oval:ssg-test_home_partition_nosuid_optional_yes:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_home_partition_nosuid_optional_yes:obj:1 of type partition_object
| Mount point |
|---|
| /home |
Add nodev Option to /var/log/audit
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nodev |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-mount_option_var_log_audit_nodev:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83882-1 References: CCI-001764, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, 1.1.6.3 |
| Description | The nodev mount option can be used to prevent device files from
being created in /var/log/audit.
Legitimate character and block devices should exist only in
the /dev directory on the root partition or within chroot
jails built for system services.
Add the nodev option to the fourth column of
/etc/fstab for the line which controls mounting of
/var/log/audit. |
| Rationale | The only legitimate location for device files is the /dev directory
located on the root partition. The only exception to this is chroot jails. |
nodev on /var/log/audit optional yes oval:ssg-test_var_log_audit_partition_nodev_optional_yes:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_var_log_audit_partition_nodev_optional_yes:obj:1 of type partition_object
| Mount point |
|---|
| /var/log/audit |
Add noexec Option to /var/log/audit
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_noexec |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-mount_option_var_log_audit_noexec:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83878-9 References: CCI-001764, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, 1.1.6.2 |
| Description | The noexec mount option can be used to prevent binaries
from being executed out of /var/log/audit.
Add the noexec option to the fourth column of
/etc/fstab for the line which controls mounting of
/var/log/audit. |
| Rationale | Allowing users to execute binaries from directories containing audit log files
such as /var/log/audit should never be necessary in normal operation and
can expose the system to potential compromise. |
noexec on /var/log/audit optional yes oval:ssg-test_var_log_audit_partition_noexec_optional_yes:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_var_log_audit_partition_noexec_optional_yes:obj:1 of type partition_object
| Mount point |
|---|
| /var/log/audit |
Add nosuid Option to /var/log/audit
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_log_audit_nosuid |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-mount_option_var_log_audit_nosuid:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83893-8 References: CCI-001764, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, 1.1.6.4 |
| Description | The nosuid mount option can be used to prevent
execution of setuid programs in /var/log/audit. The SUID and SGID permissions
should not be required in directories containing audit log files.
Add the nosuid option to the fourth column of
/etc/fstab for the line which controls mounting of
/var/log/audit. |
| Rationale | The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from partitions
designated for audit log files. |
nosuid on /var/log/audit optional yes oval:ssg-test_var_log_audit_partition_nosuid_optional_yes:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_var_log_audit_partition_nosuid_optional_yes:obj:1 of type partition_object
| Mount point |
|---|
| /var/log/audit |
Add nodev Option to /var/log
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_log_nodev |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-mount_option_var_log_nodev:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83886-2 References: CCI-001764, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, 1.1.5.2 |
| Description | The nodev mount option can be used to prevent device files from
being created in /var/log.
Legitimate character and block devices should exist only in
the /dev directory on the root partition or within chroot
jails built for system services.
Add the nodev option to the fourth column of
/etc/fstab for the line which controls mounting of
/var/log. |
| Rationale | The only legitimate location for device files is the /dev directory
located on the root partition. The only exception to this is chroot jails. |
nodev on /var/log optional yes oval:ssg-test_var_log_partition_nodev_optional_yes:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_var_log_partition_nodev_optional_yes:obj:1 of type partition_object
| Mount point |
|---|
| /var/log |
Add noexec Option to /var/log
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_log_noexec |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-mount_option_var_log_noexec:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83887-0 References: BP28(R12), CCI-001764, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, 1.1.5.3 |
| Description | The noexec mount option can be used to prevent binaries
from being executed out of /var/log.
Add the noexec option to the fourth column of
/etc/fstab for the line which controls mounting of
/var/log. |
| Rationale | Allowing users to execute binaries from directories containing log files
such as /var/log should never be necessary in normal operation and
can expose the system to potential compromise. |
noexec on /var/log optional yes oval:ssg-test_var_log_partition_noexec_optional_yes:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_var_log_partition_noexec_optional_yes:obj:1 of type partition_object
| Mount point |
|---|
| /var/log |
Add nosuid Option to /var/log
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_log_nosuid |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-mount_option_var_log_nosuid:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83870-6 References: BP28(R12), CCI-001764, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, 1.1.5.4 |
| Description | The nosuid mount option can be used to prevent
execution of setuid programs in /var/log. The SUID and SGID permissions
should not be required in directories containing log files.
Add the nosuid option to the fourth column of
/etc/fstab for the line which controls mounting of
/var/log. |
| Rationale | The presence of SUID and SGID executables should be tightly controlled. Users
should not be able to execute SUID or SGID binaries from partitions
designated for log files. |
nosuid on /var/log optional yes oval:ssg-test_var_log_partition_nosuid_optional_yes:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_var_log_partition_nosuid_optional_yes:obj:1 of type partition_object
| Mount point |
|---|
| /var/log |
Add nodev Option to /var
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_nodev |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-mount_option_var_nodev:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83868-0 References: CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-6, AC-6(1), MP-7, PR.IP-1, PR.PT-2, PR.PT-3, SRG-OS-000368-GPOS-00154, 1.1.3.2 |
| Description | The nodev mount option can be used to prevent device files from
being created in /var.
Legitimate character and block devices should exist only in
the /dev directory on the root partition or within chroot
jails built for system services.
Add the nodev option to the fourth column of
/etc/fstab for the line which controls mounting of
/var. |
| Rationale | The only legitimate location for device files is the /dev directory
located on the root partition. The only exception to this is chroot jails. |
nodev on /var optional yes oval:ssg-test_var_partition_nodev_optional_yes:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_var_partition_nodev_optional_yes:obj:1 of type partition_object
| Mount point |
|---|
| /var |
Add nosuid Option to /var
| Rule ID | xccdf_org.ssgproject.content_rule_mount_option_var_nosuid |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-mount_option_var_nosuid:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | unknown |
| Identifiers and References | Identifiers: CCE-83867-2 |
| Description | The nosuid mount option can be used to prevent
execution of setuid programs in /var. The SUID and SGID permissions
should not be required for this directory.
Add the nosuid option to the fourth column of
/etc/fstab for the line which controls mounting of
/var. |
| Rationale | The presence of SUID and SGID executables should be tightly controlled. |
nosuid on /var optional yes oval:ssg-test_var_partition_nosuid_optional_yes:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_var_partition_nosuid_optional_yes:obj:1 of type partition_object
| Mount point |
|---|
| /var |
Disable core dump backtraces
| Rule ID | xccdf_org.ssgproject.content_rule_coredump_disable_backtraces |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-coredump_disable_backtraces:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83984-5 References: CCI-000366, CM-6, FMT_SMF_EXT.1, SRG-OS-000480-GPOS-00227, 1.5.2 |
| Description | The ProcessSizeMax option in [Coredump] section
of /etc/systemd/coredump.conf
specifies the maximum size in bytes of a core which will be processed.
Core dumps exceeding this size may be stored, but the backtrace will not
be generated. |
| Rationale | A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data
and is generally useful only for developers or system operators trying to
debug problems.
Enabling core dumps on production systems is not recommended,
however there may be overriding operational requirements to enable advanced
debuging. Permitting temporary enablement of core dumps during such situations
should be reviewed through local needs and policy. |
| Warnings | warning
If the /etc/systemd/coredump.conf file
does not already contain the [Coredump] section,
the value will not be configured correctly. |
tests the value of ProcessSizeMax setting in the /etc/systemd/coredump.conf file oval:ssg-test_coredump_disable_backtraces:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_coredump_disable_backtraces:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/systemd/coredump.conf | ^\s*\[Coredump\].*(?:\n\s*[^[\s].*)*\n^[ \t]*(?i)ProcessSizeMax(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#) | 1 |
Disable storing core dump
| Rule ID | xccdf_org.ssgproject.content_rule_coredump_disable_storage |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-coredump_disable_storage:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83979-5 References: CCI-000366, CM-6, FMT_SMF_EXT.1, SRG-OS-000480-GPOS-00227, 1.5.1 |
| Description | The Storage option in [Coredump] section
of /etc/systemd/coredump.conf
can be set to none to disable storing core dumps permanently. |
| Rationale | A core dump includes a memory image taken at the time the operating system
terminates an application. The memory image could contain sensitive data
and is generally useful only for developers or system operators trying to
debug problems. Enabling core dumps on production systems is not recommended,
however there may be overriding operational requirements to enable advanced
debuging. Permitting temporary enablement of core dumps during such situations
should be reviewed through local needs and policy. |
| Warnings | warning
If the /etc/systemd/coredump.conf file
does not already contain the [Coredump] section,
the value will not be configured correctly. |
tests the value of Storage setting in the /etc/systemd/coredump.conf file oval:ssg-test_coredump_disable_storage:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_coredump_disable_storage:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/systemd/coredump.conf | ^\s*\[Coredump\].*(?:\n\s*[^[\s].*)*\n^[ \t]*(?i)Storage(?-i)[ \t]*=[ \t]*(.+?)[ \t]*(?:$|#) | 1 |
Enable Randomized Layout of Virtual Address Space
| Rule ID | xccdf_org.ssgproject.content_rule_sysctl_kernel_randomize_va_space |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sysctl_kernel_randomize_va_space:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-83971-2 References: BP28(R23), 3.1.7, CCI-000366, CCI-002824, 164.308(a)(1)(ii)(D), 164.308(a)(3), 164.308(a)(4), 164.310(b), 164.310(c), 164.312(a), 164.312(e), CIP-002-5 R1.1, CIP-002-5 R1.2, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 4.1, CIP-004-6 4.2, CIP-004-6 R2.2.3, CIP-004-6 R2.2.4, CIP-004-6 R2.3, CIP-004-6 R4, CIP-005-6 R1, CIP-005-6 R1.1, CIP-005-6 R1.2, CIP-007-3 R3, CIP-007-3 R3.1, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.1.3, CIP-007-3 R5.2.1, CIP-007-3 R5.2.3, CIP-007-3 R8.4, CIP-009-6 R.1.1, CIP-009-6 R4, SC-30, SC-30(2), CM-6(a), Req-2.2.1, SRG-OS-000433-GPOS-00193, SRG-OS-000480-GPOS-00227, 1.5.3 |
| Description | To set the runtime status of the kernel.randomize_va_space kernel parameter, run the following command: $ sudo sysctl -w kernel.randomize_va_space=2To make sure that the setting is persistent, add the following line to a file in the directory /etc/sysctl.d: kernel.randomize_va_space = 2 |
| Rationale | Address space layout randomization (ASLR) makes it more difficult for an
attacker to predict the location of attack code they have introduced into a
process's address space during an attempt at exploitation. Additionally,
ASLR makes it more difficult for an attacker to know the location of
existing code in order to re-purpose it using return oriented programming
(ROP) techniques. |
kernel.randomize_va_space static configuration oval:ssg-test_sysctl_kernel_randomize_va_space_static:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_sysctl_sysctl_kernel_randomize_va_space:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/sysctl.conf | ^[\s]*kernel.randomize_va_space[\s]*=[\s]*(.*)[\s]*$ | 1 |
kernel.randomize_va_space static configuration in /etc/sysctl.d/*.conf oval:ssg-test_sysctl_kernel_randomize_va_space_static_etc_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_etc_sysctld_sysctl_kernel_randomize_va_space:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/sysctl.d | ^.*\.conf$ | ^[\s]*kernel.randomize_va_space[\s]*=[\s]*(.*)[\s]*$ | 1 |
kernel.randomize_va_space static configuration in /run/sysctl.d/*.conf oval:ssg-test_sysctl_kernel_randomize_va_space_static_run_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_run_sysctld_sysctl_kernel_randomize_va_space:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /run/sysctl.d | ^.*\.conf$ | ^[\s]*kernel.randomize_va_space[\s]*=[\s]*(.*)[\s]*$ | 1 |
kernel.randomize_va_space static configuration in /usr/local/lib/sysctl.d/*.conf oval:ssg-test_sysctl_kernel_randomize_va_space_static_usr_local_lib_sysctld:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_static_usr_local_lib_sysctld_sysctl_kernel_randomize_va_space:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /usr/local/lib/sysctl.d | ^.*\.conf$ | ^[\s]*kernel.randomize_va_space[\s]*=[\s]*(.*)[\s]*$ | 1 |
kernel.randomize_va_space static configuration oval:ssg-test_sysctl_kernel_randomize_va_space_not_defined:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_sysctl_kernel_randomize_va_space_static_set_sysctls_unfiltered:obj:1 of type textfilecontent54_object
| Set |
|---|
| oval:ssg-object_static_etc_sysctls_sysctl_kernel_randomize_va_space:obj:1 oval:ssg-object_static_run_usr_local_sysctls_sysctl_kernel_randomize_va_space:obj:1 |
kernel runtime parameter kernel.randomize_va_space set to 2 oval:ssg-test_sysctl_kernel_randomize_va_space_runtime:tst:1 true
Following items have been found on the system:
| Name | Value |
|---|---|
| kernel.randomize_va_space | 2 |
Enable the antivirus_can_scan_system SELinux Boolean
| Rule ID | xccdf_org.ssgproject.content_rule_sebool_antivirus_can_scan_system |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sebool_antivirus_can_scan_system:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | References: 3.7.2 |
| Description | By default, the SELinux boolean antivirus_can_scan_system is disabled.
This setting should be enabled as it allows antivirus programs to read non-security
files on a system.
To enable the antivirus_can_scan_system SELinux boolean, run the following command:
$ sudo setsebool -P antivirus_can_scan_system on |
| Rationale |
antivirus_can_scan_system is configured correctly oval:ssg-test_sebool_antivirus_can_scan_system:tst:1 true
Following items have been found on the system:
| Name | Current status | Pending status |
|---|---|---|
| antivirus_can_scan_system | false | false |
Enable the auditadm_exec_content SELinux Boolean
| Rule ID | xccdf_org.ssgproject.content_rule_sebool_auditadm_exec_content |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sebool_auditadm_exec_content:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84090-0 |
| Description | By default, the SELinux boolean auditadm_exec_content is enabled.
If this setting is disabled, it should be enabled.
To enable the auditadm_exec_content SELinux boolean, run the following command:
$ sudo setsebool -P auditadm_exec_content on |
| Rationale |
auditadm_exec_content is configured correctly oval:ssg-test_sebool_auditadm_exec_content:tst:1 true
Following items have been found on the system:
| Name | Current status | Pending status |
|---|---|---|
| auditadm_exec_content | true | true |
Enable the fips_mode SELinux Boolean
| Rule ID | xccdf_org.ssgproject.content_rule_sebool_fips_mode |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sebool_fips_mode:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | References: 13, APO01.06, DSS05.04, DSS05.07, DSS06.02, 3.13.11, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, SC-12(2), SC-12(3), IA-7, SC-13, CM-6(a), SC-12, PR.DS-5 |
| Description | By default, the SELinux boolean fips_mode is enabled.
This allows all SELinux domains to execute in fips_mode.
If this setting is disabled, it should be enabled.
To enable the fips_mode SELinux boolean, run the following command:
$ sudo setsebool -P fips_mode on |
| Rationale |
fips_mode is configured correctly oval:ssg-test_sebool_fips_mode:tst:1 true
Following items have been found on the system:
| Name | Current status | Pending status |
|---|---|---|
| fips_mode | true | true |
Install libselinux Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_libselinux_installed |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_libselinux_installed:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | high |
| Identifiers and References | Identifiers: CCE-84069-4 References: 1.6.1.1 |
| Description | The libselinux package can be installed with the following command:
$ sudo dnf install libselinux |
| Rationale | Security-enhanced Linux is a feature of the Linux kernel and a number of utilities
with enhanced security functionality designed to add mandatory access controls to Linux.
The libselinux package contains the core library of the Security-enhanced Linux system. |
package libselinux is installed oval:ssg-test_package_libselinux_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| libselinux | x86_64 | (none) | 1.el9 | 3.5 | 0:3.5-1.el9 | 199e2f91fd431d51 | libselinux-0:3.5-1.el9.x86_64 |
Uninstall mcstrans Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_mcstrans_removed |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_mcstrans_removed:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | low |
| Identifiers and References | Identifiers: CCE-84072-8 References: 1.6.1.8 |
| Description | The mcstransd daemon provides category label information
to client processes requesting information. The label translations are defined
in /etc/selinux/targeted/setrans.conf.
The mcstrans package can be removed with the following command:
$ sudo dnf erase mcstrans |
| Rationale | Since this service is not used very often, disable it to reduce the
amount of potentially vulnerable code running on the system. |
package mcstrans is removed oval:ssg-test_package_mcstrans_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_mcstrans_removed:obj:1 of type rpminfo_object
| Name |
|---|
| mcstrans |
Uninstall setroubleshoot Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_setroubleshoot_removed |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_setroubleshoot_removed:def:1 |
| Time | 2023-07-10T14:11:28+05:00 |
| Severity | low |
| Identifiers and References | Identifiers: CCE-84073-6 |
| Description | The SETroubleshoot service notifies desktop users of SELinux
denials. The service provides information around configuration errors,
unauthorized intrusions, and other potential errors.
The setroubleshoot package can be removed with the following command:
$ sudo dnf erase setroubleshoot |
| Rationale | The SETroubleshoot service is an unnecessary daemon to
have running on a server, especially if
X Windows is removed or disabled. |
package setroubleshoot is removed oval:ssg-test_package_setroubleshoot_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_setroubleshoot_removed:obj:1 of type rpminfo_object
| Name |
|---|
| setroubleshoot |
Ensure SELinux Not Disabled in /etc/default/grub
check value selinux|enforcing=0 in /etc/default/grub, fail if found oval:ssg-test_selinux_default_grub:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_selinux_default_grub:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/default/grub | ^[\s]*GRUB_CMDLINE_LINUX.*(selinux|enforcing)=0.*$ | 1 |
check value selinux|enforcing=0 in /etc/grub2.cfg, fail if found oval:ssg-test_selinux_grub2_cfg:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_selinux_grub2_cfg:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/grub2.cfg | ^.*(selinux|enforcing)=0.*$ | 1 |
check value selinux|enforcing=0 in /etc/grub.d fail if found oval:ssg-test_selinux_grub_dir:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_selinux_grub_dir:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/grub.d | ^.*$ | ^.*(selinux|enforcing)=0.*$ | 1 |
Ensure No Daemons are Unconfined by SELinux
| Rule ID | xccdf_org.ssgproject.content_rule_selinux_confinement_of_daemons |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-selinux_confinement_of_daemons:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84075-1 References: 1, 11, 12, 13, 14, 15, 16, 18, 3, 5, 6, 9, APO01.06, APO11.04, BAI03.05, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.06, MEA02.01, 3.1.2, 3.1.5, 3.7.2, 164.308(a)(1)(ii)(D), 164.308(a)(3), 164.308(a)(4), 164.310(b), 164.310(c), 164.312(a), 164.312(e), 4.3.3.3.9, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.10, SR 2.11, SR 2.12, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 2.8, SR 2.9, SR 5.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.5.1, A.12.6.2, A.12.7.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, CM-7(a), CM-7(b), CM-6(a), AC-3(3)(a), AC-6, PR.AC-4, PR.DS-5, PR.IP-1, PR.PT-1, PR.PT-3, 1.6.1.6 |
| Description | Daemons for which the SELinux policy does not contain rules will inherit the
context of the parent process. Because daemons are launched during
startup and descend from the init process, they inherit the unconfined_service_t context.
To check for unconfined daemons, run the following command: $ sudo ps -eZ | grep "unconfined_service_t"It should produce no output in a well-configured system. |
| Rationale | Daemons which run with the unconfined_service_t context may cause AVC denials,
or allow privileges that the daemon does not require. |
| Warnings | warning
Automatic remediation of this control is not available. Remediation
can be achieved by amending SELinux policy or stopping the unconfined
daemons as outlined above. |
none satisfy unconfined_service_t in /proc oval:ssg-test_selinux_confinement_of_daemons:tst:1 false
Following items have been found on the system:
| Filepath | Path | Filename | User | Role | Type | Low sensitivity | Rawlow sensitivity |
|---|---|---|---|---|---|---|---|
| /proc/893/environ | /proc/893 | environ | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/mountstats | /proc/893 | mountstats | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/clear_refs | /proc/893 | clear_refs | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/smaps | /proc/893 | smaps | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/smaps_rollup | /proc/893 | smaps_rollup | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/pagemap | /proc/893 | pagemap | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/wchan | /proc/893 | wchan | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/stack | /proc/893 | stack | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/schedstat | /proc/893 | schedstat | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/cpuset | /proc/893 | cpuset | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/cgroup | /proc/893 | cgroup | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/cpu_resctrl_groups | /proc/893 | cpu_resctrl_groups | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/oom_score | /proc/893 | oom_score | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/oom_adj | /proc/893 | oom_adj | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/oom_score_adj | /proc/893 | oom_score_adj | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/loginuid | /proc/893 | loginuid | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/sessionid | /proc/893 | sessionid | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/auxv | /proc/893 | auxv | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/personality | /proc/893 | personality | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/limits | /proc/893 | limits | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/sched | /proc/893 | sched | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/autogroup | /proc/893 | autogroup | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/timens_offsets | /proc/893 | timens_offsets | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/comm | /proc/893 | comm | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/syscall | /proc/893 | syscall | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/cmdline | /proc/893 | cmdline | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/stat | /proc/893 | stat | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/statm | /proc/893 | statm | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/maps | /proc/893 | maps | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/numa_maps | /proc/893 | numa_maps | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/mem | /proc/893 | mem | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/mounts | /proc/893 | mounts | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/mountinfo | /proc/893 | mountinfo | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/status | /proc/893 | status | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/coredump_filter | /proc/893 | coredump_filter | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/io | /proc/893 | io | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/uid_map | /proc/893 | uid_map | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/gid_map | /proc/893 | gid_map | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/projid_map | /proc/893 | projid_map | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/setgroups | /proc/893 | setgroups | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/timers | /proc/893 | timers | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/timerslack_ns | /proc/893 | timerslack_ns | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/patch_state | /proc/893 | patch_state | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/893/arch_status | /proc/893 | arch_status | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/status | /proc/1983 | status | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/personality | /proc/1983 | personality | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/limits | /proc/1983 | limits | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/environ | /proc/1983 | environ | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/auxv | /proc/1983 | auxv | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/sched | /proc/1983 | sched | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/autogroup | /proc/1983 | autogroup | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/timens_offsets | /proc/1983 | timens_offsets | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/comm | /proc/1983 | comm | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/syscall | /proc/1983 | syscall | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/cmdline | /proc/1983 | cmdline | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/stat | /proc/1983 | stat | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/statm | /proc/1983 | statm | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/maps | /proc/1983 | maps | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/numa_maps | /proc/1983 | numa_maps | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/mem | /proc/1983 | mem | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/mounts | /proc/1983 | mounts | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/mountinfo | /proc/1983 | mountinfo | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/mountstats | /proc/1983 | mountstats | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/clear_refs | /proc/1983 | clear_refs | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/smaps | /proc/1983 | smaps | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/smaps_rollup | /proc/1983 | smaps_rollup | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/pagemap | /proc/1983 | pagemap | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/wchan | /proc/1983 | wchan | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/stack | /proc/1983 | stack | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/schedstat | /proc/1983 | schedstat | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/cpuset | /proc/1983 | cpuset | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/cgroup | /proc/1983 | cgroup | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/cpu_resctrl_groups | /proc/1983 | cpu_resctrl_groups | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/oom_score | /proc/1983 | oom_score | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/oom_adj | /proc/1983 | oom_adj | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/oom_score_adj | /proc/1983 | oom_score_adj | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/loginuid | /proc/1983 | loginuid | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/sessionid | /proc/1983 | sessionid | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/coredump_filter | /proc/1983 | coredump_filter | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/io | /proc/1983 | io | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/uid_map | /proc/1983 | uid_map | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/gid_map | /proc/1983 | gid_map | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/projid_map | /proc/1983 | projid_map | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/setgroups | /proc/1983 | setgroups | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/timers | /proc/1983 | timers | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/timerslack_ns | /proc/1983 | timerslack_ns | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/patch_state | /proc/1983 | patch_state | system_u | system_r | unconfined_service_t | s0 | s0 |
| /proc/1983/arch_status | /proc/1983 | arch_status | system_u | system_r | unconfined_service_t | s0 | s0 |
Configure SELinux Policy
| Rule ID | xccdf_org.ssgproject.content_rule_selinux_policytype |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-selinux_policytype:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84074-4 References: BP28(R66), 1, 11, 12, 13, 14, 15, 16, 18, 3, 4, 5, 6, 8, 9, APO01.06, APO11.04, APO13.01, BAI03.05, DSS01.05, DSS03.01, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.03, DSS06.06, MEA02.01, 3.1.2, 3.7.2, CCI-002165, CCI-002696, 164.308(a)(1)(ii)(D), 164.308(a)(3), 164.308(a)(4), 164.310(b), 164.310(c), 164.312(a), 164.312(e), 4.2.3.4, 4.3.3.2.2, 4.3.3.3.9, 4.3.3.4, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.4.7, 4.4.2.1, 4.4.2.2, 4.4.2.4, 4.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.10, SR 2.11, SR 2.12, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 2.8, SR 2.9, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.1, A.12.1.2, A.12.4.1, A.12.4.2, A.12.4.3, A.12.4.4, A.12.7.1, A.13.1.1, A.13.1.2, A.13.1.3, A.13.2.1, A.13.2.2, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.2, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-004-6 R3.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, CIP-007-3 R6.5, AC-3, AC-3(3)(a), AU-9, SC-7(21), DE.AE-1, ID.AM-3, PR.AC-4, PR.AC-5, PR.AC-6, PR.DS-5, PR.PT-1, PR.PT-3, PR.PT-4, SRG-OS-000445-GPOS-00199, SRG-OS-000445-VMM-001780, 1.6.1.3 |
| Description | The SELinux targeted policy is appropriate for
general-purpose desktops and servers, as well as systems in many other roles.
To configure the system to use this policy, add or correct the following line
in /etc/selinux/config:
SELINUXTYPE=targetedOther policies, such as mls, provide additional security labeling
and greater confinement but are not compatible with many general-purpose
use cases. |
| Rationale | Setting the SELinux policy to targeted or a more specialized policy
ensures the system will confine processes that are likely to be
targeted for exploitation, such as network or system services.
Note: During the development or debugging of SELinux modules, it is common to temporarily place non-production systems in permissive mode. In such
temporary cases, SELinux policies should be developed, and once work
is completed, the system should be reconfigured to
targeted. |
Tests the value of the ^[\s]*SELINUXTYPE[\s]*=[\s]*([^#]*) expression in the /etc/selinux/config file oval:ssg-test_selinux_policy:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /etc/selinux/config | SELINUXTYPE=targeted |
Ensure SELinux State is Enforcing
/selinux/enforce is 1 oval:ssg-test_etc_selinux_config:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /etc/selinux/config | SELINUX=enforcing |
Ensure that /etc/at.deny does not exist
| Rule ID | xccdf_org.ssgproject.content_rule_file_at_deny_not_exist |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_at_deny_not_exist:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-86946-1 References: 5.1.9 |
| Description | The file /etc/at.deny should not exist.
Use /etc/at.allow instead. |
| Rationale | Access to at should be restricted.
It is easier to manage an allow list than a deny list. |
Test that that /etc/at.deny does not exist oval:ssg-test_file_at_deny_not_exist:tst:1 false
Following items have been found on the system:
| Path | Type | UID | GID | Size (B) | Permissions |
|---|---|---|---|---|---|
| /etc/at.deny | regular | 0 | 0 | 1 | rw-r--r-- |
Ensure that /etc/cron.deny does not exist
| Rule ID | xccdf_org.ssgproject.content_rule_file_cron_deny_not_exist |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_cron_deny_not_exist:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-86850-5 References: 5.1.8 |
| Description | The file /etc/cron.deny should not exist.
Use /etc/cron.allow instead. |
| Rationale | Access to cron should be restricted.
It is easier to manage an allow list than a deny list. |
Test that that /etc/cron.deny does not exist oval:ssg-test_file_cron_deny_not_exist:tst:1 false
Following items have been found on the system:
| Path | Type | UID | GID | Size (B) | Permissions |
|---|---|---|---|---|---|
| /etc/cron.deny | regular | 0 | 0 | 0 | rw-r--r-- |
Verify Group Who Owns /etc/at.allow file
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_at_allow |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_at_allow:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-87103-8 References: 5.1.9 |
| Description | If /etc/at.allow exists, it must be group-owned by root.
To properly set the group owner of /etc/at.allow, run the command:
$ sudo chgrp root /etc/at.allow |
| Rationale | If the owner of the at.allow file is not set to root, the possibility exists for an
unauthorized user to view or edit sensitive information. |
Testing group ownership of /etc/at.allow oval:ssg-test_file_groupowner_at_allow_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_at_allow_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/at.allow | oval:ssg-symlink_file_groupowner_at_allow_uid_0:ste:1 | oval:ssg-state_file_groupowner_at_allow_gid_0_0:ste:1 |
Verify Group Who Owns /etc/cron.allow file
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_cron_allow |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_cron_allow:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-86830-7 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, CCI-000366, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, SRG-OS-000480-GPOS-00227, 5.1.8 |
| Description | If /etc/cron.allow exists, it must be group-owned by root.
To properly set the group owner of /etc/cron.allow, run the command:
$ sudo chgrp root /etc/cron.allow |
| Rationale | If the owner of the cron.allow file is not set to root, the possibility exists for an
unauthorized user to view or edit sensitive information. |
Testing group ownership of /etc/cron.allow oval:ssg-test_file_groupowner_cron_allow_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_cron_allow_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/cron.allow | oval:ssg-symlink_file_groupowner_cron_allow_uid_0:ste:1 | oval:ssg-state_file_groupowner_cron_allow_gid_0_0:ste:1 |
Verify User Who Owns /etc/cron.allow file
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_cron_allow |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_cron_allow:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-86844-8 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, CCI-000366, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, SRG-OS-000480-GPOS-00227, 5.1.8 |
| Description | If /etc/cron.allow exists, it must be owned by root.
To properly set the owner of /etc/cron.allow, run the command:
$ sudo chown root /etc/cron.allow |
| Rationale | If the owner of the cron.allow file is not set to root, the possibility exists for an
unauthorized user to view or edit sensitive information. |
Testing user ownership of /etc/cron.allow oval:ssg-test_file_owner_cron_allow_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_cron_allow_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/cron.allow | oval:ssg-symlink_file_owner_cron_allow_uid_0:ste:1 | oval:ssg-state_file_owner_cron_allow_uid_0_0:ste:1 |
Install the cron service
| Rule ID | xccdf_org.ssgproject.content_rule_package_cron_installed |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_cron_installed:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | References: BP28(R50), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-6(a), PR.IP-1, PR.PT-3 |
| Description | The Cron service should be installed. |
| Rationale | The cron service allow periodic job execution, needed for almost all administrative tasks and services (software update, log rotating, etc.). Access to cron service should be restricted to administrative accounts only. |
package cron is installed oval:ssg-test_package_cron_installed:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_cron_installed:obj:1 of type rpminfo_object
| Name |
|---|
| cron |
Enable cron Service
| Rule ID | xccdf_org.ssgproject.content_rule_service_cron_enabled |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_cron_enabled:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | References: 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-6(a), PR.IP-1, PR.PT-3 |
| Description | The crond service is used to execute commands at
preconfigured times. It is required by almost all systems to perform necessary
maintenance tasks, such as notifying root of system activity.
The cron service can be enabled with the following command:
$ sudo systemctl enable cron.service |
| Rationale | Due to its usage for maintenance and security-supporting tasks,
enabling the cron daemon is essential. |
package cron is installed oval:ssg-test_service_cron_package_cron_installed:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_service_cron_package_cron_installed:obj:1 of type rpminfo_object
| Name |
|---|
| cron |
Test that the cron service is running oval:ssg-test_service_running_cron:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_running_cron:obj:1 of type systemdunitproperty_object
| Unit | Property |
|---|---|
| ^cron\.(socket|service)$ | ActiveState |
systemd test oval:ssg-test_multi_user_wants_cron:tst:1 false
Following items have been found on the system:
| Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| multi-user.target | basic.target | -.mount | sysinit.target | systemd-sysusers.service | systemd-sysctl.service | sys-fs-fuse-connections.mount | local-fs.target | boot-efi.mount | boot.mount | systemd-remount-fs.service | ostree-remount.service | ldconfig.service | systemd-repart.service | systemd-tmpfiles-setup.service | sys-kernel-debug.mount | systemd-udevd.service | selinux-autorelabel-mark.service | cryptsetup.target | systemd-pcrphase-sysinit.service | dev-hugepages.mount | iscsi-onboot.service | systemd-journal-flush.service | systemd-ask-password-console.path | swap.target | dev-mapper-rhel\x2dswap.swap | systemd-tmpfiles-setup-dev.service | dev-mqueue.mount | lvm2-lvmpolld.socket | multipathd.service | sys-kernel-config.mount | systemd-boot-system-token.service | systemd-random-seed.service | systemd-journal-catalog-update.service | systemd-udev-trigger.service | systemd-hwdb-update.service | plymouth-start.service | dracut-shutdown.service | systemd-update-done.service | systemd-pcrphase.service | veritysetup.target | lvm2-monitor.service | integritysetup.target | systemd-network-generator.service | systemd-boot-update.service | systemd-journald.service | proc-sys-fs-binfmt_misc.automount | sys-kernel-tracing.mount | systemd-firstboot.service | systemd-binfmt.service | systemd-modules-load.service | systemd-machine-id-commit.service | plymouth-read-write.service | kmod-static-nodes.service | systemd-update-utmp.service | nis-domainname.service | slices.target | -.slice | system.slice | microcode.service | low-memory-monitor.service | timers.target | systemd-tmpfiles-clean.timer | mlocate-updatedb.timer | logrotate.timer | dnf-makecache.timer | sockets.target | dbus.socket | multipathd.socket | iscsiuio.socket | avahi-daemon.socket | sssd-kcm.socket | systemd-udevd-kernel.socket | dm-event.socket | systemd-initctl.socket | cups.socket | systemd-coredump.socket | systemd-journald.socket | iscsid.socket | systemd-journald-dev-log.socket | systemd-udevd-control.socket | paths.target | ostree-readonly-sysroot-migration.service | mcelog.service | plymouth-quit.service | ModemManager.service | libstoragemgmt.service | smartd.service | plymouth-quit-wait.service | NetworkManager.service | irqbalance.service | avahi-daemon.service | remote-fs.target | iscsi.service | insights-client-boot.service | sshd.service | chronyd.service | cups.service | getty.target | getty@tty1.service | tuned.service | auditd.service | kdump.service | vmtoolsd.service | crond.service | firewalld.service | systemd-ask-password-wall.path | rsyslog.service | cups.path | systemd-logind.service | rhsmcertd.service | atd.service | sssd.service | systemd-update-utmp-runlevel.service | mdmonitor.service | systemd-user-sessions.service |
systemd test oval:ssg-test_multi_user_wants_cron_socket:tst:1 false
Following items have been found on the system:
| Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| multi-user.target | basic.target | -.mount | sysinit.target | systemd-sysusers.service | systemd-sysctl.service | sys-fs-fuse-connections.mount | local-fs.target | boot-efi.mount | boot.mount | systemd-remount-fs.service | ostree-remount.service | ldconfig.service | systemd-repart.service | systemd-tmpfiles-setup.service | sys-kernel-debug.mount | systemd-udevd.service | selinux-autorelabel-mark.service | cryptsetup.target | systemd-pcrphase-sysinit.service | dev-hugepages.mount | iscsi-onboot.service | systemd-journal-flush.service | systemd-ask-password-console.path | swap.target | dev-mapper-rhel\x2dswap.swap | systemd-tmpfiles-setup-dev.service | dev-mqueue.mount | lvm2-lvmpolld.socket | multipathd.service | sys-kernel-config.mount | systemd-boot-system-token.service | systemd-random-seed.service | systemd-journal-catalog-update.service | systemd-udev-trigger.service | systemd-hwdb-update.service | plymouth-start.service | dracut-shutdown.service | systemd-update-done.service | systemd-pcrphase.service | veritysetup.target | lvm2-monitor.service | integritysetup.target | systemd-network-generator.service | systemd-boot-update.service | systemd-journald.service | proc-sys-fs-binfmt_misc.automount | sys-kernel-tracing.mount | systemd-firstboot.service | systemd-binfmt.service | systemd-modules-load.service | systemd-machine-id-commit.service | plymouth-read-write.service | kmod-static-nodes.service | systemd-update-utmp.service | nis-domainname.service | slices.target | -.slice | system.slice | microcode.service | low-memory-monitor.service | timers.target | systemd-tmpfiles-clean.timer | mlocate-updatedb.timer | logrotate.timer | dnf-makecache.timer | sockets.target | dbus.socket | multipathd.socket | iscsiuio.socket | avahi-daemon.socket | sssd-kcm.socket | systemd-udevd-kernel.socket | dm-event.socket | systemd-initctl.socket | cups.socket | systemd-coredump.socket | systemd-journald.socket | iscsid.socket | systemd-journald-dev-log.socket | systemd-udevd-control.socket | paths.target | ostree-readonly-sysroot-migration.service | mcelog.service | plymouth-quit.service | ModemManager.service | libstoragemgmt.service | smartd.service | plymouth-quit-wait.service | NetworkManager.service | irqbalance.service | avahi-daemon.service | remote-fs.target | iscsi.service | insights-client-boot.service | sshd.service | chronyd.service | cups.service | getty.target | getty@tty1.service | tuned.service | auditd.service | kdump.service | vmtoolsd.service | crond.service | firewalld.service | systemd-ask-password-wall.path | rsyslog.service | cups.path | systemd-logind.service | rhsmcertd.service | atd.service | sssd.service | systemd-update-utmp-runlevel.service | mdmonitor.service | systemd-user-sessions.service |
Enable cron Service
| Rule ID | xccdf_org.ssgproject.content_rule_service_crond_enabled |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_crond_enabled:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84163-5 References: 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-6(a), PR.IP-1, PR.PT-3, 5.1.1 |
| Description | The crond service is used to execute commands at
preconfigured times. It is required by almost all systems to perform necessary
maintenance tasks, such as notifying root of system activity.
The crond service can be enabled with the following command:
$ sudo systemctl enable crond.service |
| Rationale | Due to its usage for maintenance and security-supporting tasks,
enabling the cron daemon is essential. |
package cronie is installed oval:ssg-test_service_crond_package_cronie_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| cronie | x86_64 | (none) | 8.el9 | 1.5.7 | 0:1.5.7-8.el9 | 199e2f91fd431d51 | cronie-0:1.5.7-8.el9.x86_64 |
Test that the crond service is running oval:ssg-test_service_running_crond:tst:1 true
Following items have been found on the system:
| Unit | Property | Value |
|---|---|---|
| crond.service | ActiveState | active |
systemd test oval:ssg-test_multi_user_wants_crond:tst:1 true
Following items have been found on the system:
| Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| multi-user.target | basic.target | -.mount | sysinit.target | systemd-sysusers.service | systemd-sysctl.service | sys-fs-fuse-connections.mount | local-fs.target | boot-efi.mount | boot.mount | systemd-remount-fs.service | ostree-remount.service | ldconfig.service | systemd-repart.service | systemd-tmpfiles-setup.service | sys-kernel-debug.mount | systemd-udevd.service | selinux-autorelabel-mark.service | cryptsetup.target | systemd-pcrphase-sysinit.service | dev-hugepages.mount | iscsi-onboot.service | systemd-journal-flush.service | systemd-ask-password-console.path | swap.target | dev-mapper-rhel\x2dswap.swap | systemd-tmpfiles-setup-dev.service | dev-mqueue.mount | lvm2-lvmpolld.socket | multipathd.service | sys-kernel-config.mount | systemd-boot-system-token.service | systemd-random-seed.service | systemd-journal-catalog-update.service | systemd-udev-trigger.service | systemd-hwdb-update.service | plymouth-start.service | dracut-shutdown.service | systemd-update-done.service | systemd-pcrphase.service | veritysetup.target | lvm2-monitor.service | integritysetup.target | systemd-network-generator.service | systemd-boot-update.service | systemd-journald.service | proc-sys-fs-binfmt_misc.automount | sys-kernel-tracing.mount | systemd-firstboot.service | systemd-binfmt.service | systemd-modules-load.service | systemd-machine-id-commit.service | plymouth-read-write.service | kmod-static-nodes.service | systemd-update-utmp.service | nis-domainname.service | slices.target | -.slice | system.slice | microcode.service | low-memory-monitor.service | timers.target | systemd-tmpfiles-clean.timer | mlocate-updatedb.timer | logrotate.timer | dnf-makecache.timer | sockets.target | dbus.socket | multipathd.socket | iscsiuio.socket | avahi-daemon.socket | sssd-kcm.socket | systemd-udevd-kernel.socket | dm-event.socket | systemd-initctl.socket | cups.socket | systemd-coredump.socket | systemd-journald.socket | iscsid.socket | systemd-journald-dev-log.socket | systemd-udevd-control.socket | paths.target | ostree-readonly-sysroot-migration.service | mcelog.service | plymouth-quit.service | ModemManager.service | libstoragemgmt.service | smartd.service | plymouth-quit-wait.service | NetworkManager.service | irqbalance.service | avahi-daemon.service | remote-fs.target | iscsi.service | insights-client-boot.service | sshd.service | chronyd.service | cups.service | getty.target | getty@tty1.service | tuned.service | auditd.service | kdump.service | vmtoolsd.service | crond.service | firewalld.service | systemd-ask-password-wall.path | rsyslog.service | cups.path | systemd-logind.service | rhsmcertd.service | atd.service | sssd.service | systemd-update-utmp-runlevel.service | mdmonitor.service | systemd-user-sessions.service |
systemd test oval:ssg-test_multi_user_wants_crond_socket:tst:1 false
Following items have been found on the system:
| Unit | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency | Dependency |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| multi-user.target | basic.target | -.mount | sysinit.target | systemd-sysusers.service | systemd-sysctl.service | sys-fs-fuse-connections.mount | local-fs.target | boot-efi.mount | boot.mount | systemd-remount-fs.service | ostree-remount.service | ldconfig.service | systemd-repart.service | systemd-tmpfiles-setup.service | sys-kernel-debug.mount | systemd-udevd.service | selinux-autorelabel-mark.service | cryptsetup.target | systemd-pcrphase-sysinit.service | dev-hugepages.mount | iscsi-onboot.service | systemd-journal-flush.service | systemd-ask-password-console.path | swap.target | dev-mapper-rhel\x2dswap.swap | systemd-tmpfiles-setup-dev.service | dev-mqueue.mount | lvm2-lvmpolld.socket | multipathd.service | sys-kernel-config.mount | systemd-boot-system-token.service | systemd-random-seed.service | systemd-journal-catalog-update.service | systemd-udev-trigger.service | systemd-hwdb-update.service | plymouth-start.service | dracut-shutdown.service | systemd-update-done.service | systemd-pcrphase.service | veritysetup.target | lvm2-monitor.service | integritysetup.target | systemd-network-generator.service | systemd-boot-update.service | systemd-journald.service | proc-sys-fs-binfmt_misc.automount | sys-kernel-tracing.mount | systemd-firstboot.service | systemd-binfmt.service | systemd-modules-load.service | systemd-machine-id-commit.service | plymouth-read-write.service | kmod-static-nodes.service | systemd-update-utmp.service | nis-domainname.service | slices.target | -.slice | system.slice | microcode.service | low-memory-monitor.service | timers.target | systemd-tmpfiles-clean.timer | mlocate-updatedb.timer | logrotate.timer | dnf-makecache.timer | sockets.target | dbus.socket | multipathd.socket | iscsiuio.socket | avahi-daemon.socket | sssd-kcm.socket | systemd-udevd-kernel.socket | dm-event.socket | systemd-initctl.socket | cups.socket | systemd-coredump.socket | systemd-journald.socket | iscsid.socket | systemd-journald-dev-log.socket | systemd-udevd-control.socket | paths.target | ostree-readonly-sysroot-migration.service | mcelog.service | plymouth-quit.service | ModemManager.service | libstoragemgmt.service | smartd.service | plymouth-quit-wait.service | NetworkManager.service | irqbalance.service | avahi-daemon.service | remote-fs.target | iscsi.service | insights-client-boot.service | sshd.service | chronyd.service | cups.service | getty.target | getty@tty1.service | tuned.service | auditd.service | kdump.service | vmtoolsd.service | crond.service | firewalld.service | systemd-ask-password-wall.path | rsyslog.service | cups.path | systemd-logind.service | rhsmcertd.service | atd.service | sssd.service | systemd-update-utmp-runlevel.service | mdmonitor.service | systemd-user-sessions.service |
Verify Group Who Owns cron.d
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_cron_d |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_cron_d:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84177-5 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, SRG-OS-000480-GPOS-00227, 5.1.7 |
| Description |
To properly set the group owner of /etc/cron.d, run the command:
$ sudo chgrp root /etc/cron.d |
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes. |
Testing group ownership of /etc/cron.d/ oval:ssg-test_file_groupowner_cron_d_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_cron_d_0:obj:1 of type file_object
| Path | Filename | Filter | Filter |
|---|---|---|---|
| /etc/cron.d | no value | oval:ssg-symlink_file_groupowner_cron_d_uid_0:ste:1 | oval:ssg-state_file_groupowner_cron_d_gid_0_0:ste:1 |
Verify Group Who Owns cron.daily
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_cron_daily |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_cron_daily:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84170-0 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, SRG-OS-000480-GPOS-00227, 5.1.4 |
| Description |
To properly set the group owner of /etc/cron.daily, run the command:
$ sudo chgrp root /etc/cron.daily |
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes. |
Testing group ownership of /etc/cron.daily/ oval:ssg-test_file_groupowner_cron_daily_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_cron_daily_0:obj:1 of type file_object
| Path | Filename | Filter | Filter |
|---|---|---|---|
| /etc/cron.daily | no value | oval:ssg-symlink_file_groupowner_cron_daily_uid_0:ste:1 | oval:ssg-state_file_groupowner_cron_daily_gid_0_0:ste:1 |
Verify Group Who Owns cron.hourly
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_cron_hourly |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_cron_hourly:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84186-6 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, SRG-OS-000480-GPOS-00227, 5.1.3 |
| Description |
To properly set the group owner of /etc/cron.hourly, run the command:
$ sudo chgrp root /etc/cron.hourly |
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes. |
Testing group ownership of /etc/cron.hourly/ oval:ssg-test_file_groupowner_cron_hourly_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_cron_hourly_0:obj:1 of type file_object
| Path | Filename | Filter | Filter |
|---|---|---|---|
| /etc/cron.hourly | no value | oval:ssg-symlink_file_groupowner_cron_hourly_uid_0:ste:1 | oval:ssg-state_file_groupowner_cron_hourly_gid_0_0:ste:1 |
Verify Group Who Owns cron.monthly
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_cron_monthly |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_cron_monthly:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84189-0 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, SRG-OS-000480-GPOS-00227, 5.1.6 |
| Description |
To properly set the group owner of /etc/cron.monthly, run the command:
$ sudo chgrp root /etc/cron.monthly |
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes. |
Testing group ownership of /etc/cron.monthly/ oval:ssg-test_file_groupowner_cron_monthly_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_cron_monthly_0:obj:1 of type file_object
| Path | Filename | Filter | Filter |
|---|---|---|---|
| /etc/cron.monthly | no value | oval:ssg-symlink_file_groupowner_cron_monthly_uid_0:ste:1 | oval:ssg-state_file_groupowner_cron_monthly_gid_0_0:ste:1 |
Verify Group Who Owns cron.weekly
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_cron_weekly |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_cron_weekly:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84174-2 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, SRG-OS-000480-GPOS-00227, 5.1.5 |
| Description |
To properly set the group owner of /etc/cron.weekly, run the command:
$ sudo chgrp root /etc/cron.weekly |
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes. |
Testing group ownership of /etc/cron.weekly/ oval:ssg-test_file_groupowner_cron_weekly_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_cron_weekly_0:obj:1 of type file_object
| Path | Filename | Filter | Filter |
|---|---|---|---|
| /etc/cron.weekly | no value | oval:ssg-symlink_file_groupowner_cron_weekly_uid_0:ste:1 | oval:ssg-state_file_groupowner_cron_weekly_gid_0_0:ste:1 |
Verify Group Who Owns Crontab
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_crontab |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_crontab:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84171-8 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, SRG-OS-000480-GPOS-00227, 5.1.2 |
| Description |
To properly set the group owner of /etc/crontab, run the command:
$ sudo chgrp root /etc/crontab |
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes. |
Testing group ownership of /etc/crontab oval:ssg-test_file_groupowner_crontab_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_crontab_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/crontab | oval:ssg-symlink_file_groupowner_crontab_uid_0:ste:1 | oval:ssg-state_file_groupowner_crontab_gid_0_0:ste:1 |
Verify Owner on cron.d
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_cron_d |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_cron_d:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84169-2 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, SRG-OS-000480-GPOS-00227, 5.1.7 |
| Description |
To properly set the owner of /etc/cron.d, run the command:
$ sudo chown root /etc/cron.d |
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct user to prevent unauthorized changes. |
Testing user ownership of /etc/cron.d/ oval:ssg-test_file_owner_cron_d_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_cron_d_0:obj:1 of type file_object
| Path | Filename | Filter | Filter |
|---|---|---|---|
| /etc/cron.d | no value | oval:ssg-symlink_file_owner_cron_d_uid_0:ste:1 | oval:ssg-state_file_owner_cron_d_uid_0_0:ste:1 |
Verify Owner on cron.daily
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_cron_daily |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_cron_daily:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84188-2 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, SRG-OS-000480-GPOS-00227, 5.1.4 |
| Description |
To properly set the owner of /etc/cron.daily, run the command:
$ sudo chown root /etc/cron.daily |
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct user to prevent unauthorized changes. |
Testing user ownership of /etc/cron.daily/ oval:ssg-test_file_owner_cron_daily_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_cron_daily_0:obj:1 of type file_object
| Path | Filename | Filter | Filter |
|---|---|---|---|
| /etc/cron.daily | no value | oval:ssg-symlink_file_owner_cron_daily_uid_0:ste:1 | oval:ssg-state_file_owner_cron_daily_uid_0_0:ste:1 |
Verify Owner on cron.hourly
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_cron_hourly |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_cron_hourly:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84168-4 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, SRG-OS-000480-GPOS-00227, 5.1.3 |
| Description |
To properly set the owner of /etc/cron.hourly, run the command:
$ sudo chown root /etc/cron.hourly |
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct user to prevent unauthorized changes. |
Testing user ownership of /etc/cron.hourly/ oval:ssg-test_file_owner_cron_hourly_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_cron_hourly_0:obj:1 of type file_object
| Path | Filename | Filter | Filter |
|---|---|---|---|
| /etc/cron.hourly | no value | oval:ssg-symlink_file_owner_cron_hourly_uid_0:ste:1 | oval:ssg-state_file_owner_cron_hourly_uid_0_0:ste:1 |
Verify Owner on cron.monthly
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_cron_monthly |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_cron_monthly:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84179-1 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, SRG-OS-000480-GPOS-00227, 5.1.6 |
| Description |
To properly set the owner of /etc/cron.monthly, run the command:
$ sudo chown root /etc/cron.monthly |
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct user to prevent unauthorized changes. |
Testing user ownership of /etc/cron.monthly/ oval:ssg-test_file_owner_cron_monthly_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_cron_monthly_0:obj:1 of type file_object
| Path | Filename | Filter | Filter |
|---|---|---|---|
| /etc/cron.monthly | no value | oval:ssg-symlink_file_owner_cron_monthly_uid_0:ste:1 | oval:ssg-state_file_owner_cron_monthly_uid_0_0:ste:1 |
Verify Owner on cron.weekly
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_cron_weekly |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_cron_weekly:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84190-8 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, SRG-OS-000480-GPOS-00227, 5.1.5 |
| Description |
To properly set the owner of /etc/cron.weekly, run the command:
$ sudo chown root /etc/cron.weekly |
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct user to prevent unauthorized changes. |
Testing user ownership of /etc/cron.weekly/ oval:ssg-test_file_owner_cron_weekly_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_cron_weekly_0:obj:1 of type file_object
| Path | Filename | Filter | Filter |
|---|---|---|---|
| /etc/cron.weekly | no value | oval:ssg-symlink_file_owner_cron_weekly_uid_0:ste:1 | oval:ssg-state_file_owner_cron_weekly_uid_0_0:ste:1 |
Verify Owner on crontab
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_crontab |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_crontab:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84167-6 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, SRG-OS-000480-GPOS-00227, 5.1.2 |
| Description |
To properly set the owner of /etc/crontab, run the command:
$ sudo chown root /etc/crontab |
| Rationale | Service configuration files enable or disable features of their respective services that if configured incorrectly
can lead to insecure and vulnerable configurations. Therefore, service configuration files should be owned by the
correct user to prevent unauthorized changes. |
Testing user ownership of /etc/crontab oval:ssg-test_file_owner_crontab_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_crontab_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/crontab | oval:ssg-symlink_file_owner_crontab_uid_0:ste:1 | oval:ssg-state_file_owner_crontab_uid_0_0:ste:1 |
Uninstall DHCP Server Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_dhcp_removed |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_dhcp_removed:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84240-1 References: BP28(R1), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000366, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, 2.2.4 |
| Description | If the system does not need to act as a DHCP server,
the dhcp package can be uninstalled.
The dhcp-server package can be removed with the following command:
$ sudo dnf erase dhcp-server |
| Rationale | Removing the DHCP server ensures that it cannot be easily or
accidentally reactivated and disrupt network operation. |
package dhcp-server is removed oval:ssg-test_package_dhcp-server_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_dhcp-server_removed:obj:1 of type rpminfo_object
| Name |
|---|
| dhcp-server |
Uninstall bind Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_bind_removed |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_bind_removed:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | low |
| Identifiers and References | Identifiers: CCE-86505-5 References: 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000366, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, 2.2.5 |
| Description | The named service is provided by the bind package.
The bind package can be removed with the following command:
$ sudo dnf erase bind |
| Rationale | If there is no need to make DNS server software available,
removing it provides a safeguard against its activation. |
package bind is removed oval:ssg-test_package_bind_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_bind_removed:obj:1 of type rpminfo_object
| Name |
|---|
| bind |
Uninstall vsftpd Package
package vsftpd is removed oval:ssg-test_package_vsftpd_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_vsftpd_removed:obj:1 of type rpminfo_object
| Name |
|---|
| vsftpd |
Limit Users Allowed FTP Access if Necessary
| Rule ID | xccdf_org.ssgproject.content_rule_ftp_limit_users |
| Result | notchecked |
| Multi-check rule | no |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | unknown |
| Identifiers and References | |
| Description | If there is a mission-critical reason for users to access their accounts via the insecure FTP protocol, limit the set of users who are allowed this access. Edit the vsftpd configuration file. Add or correct the following configuration options:
userlist_enable=YES userlist_file=/etc/vsftp.ftpusers userlist_deny=NOEdit the file /etc/vsftp.ftpusers. For each user USERNAME who should be allowed to access the system via FTP, add a line containing that user's name:
USERNAMEIf anonymous access is also required, add the anonymous usernames to /etc/vsftp.ftpusers as well.
anonymous ftp |
| Rationale | Historically, the file /etc/ftpusers contained a list of users who were not allowed to access the system via FTP. It was used to prevent system users such as the root user from logging in via the insecure FTP protocol. However, when the configuration option userlist deny=NO is set, vsftpd interprets ftpusers as the set of users who are allowed to login via FTP. Since it should be possible for most users to access their accounts via secure protocols, it is recommended that this setting be used, so that non-anonymous FTP access can be limited to legacy users who have been explicitly identified. |
Configure Firewalls to Protect the FTP Server
| Rule ID | xccdf_org.ssgproject.content_rule_ftp_configure_firewall |
| Result | notchecked |
| Multi-check rule | no |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | unknown |
| Identifiers and References | |
| Description |
By default, iptables
blocks access to the ports used by the web server.
To configure iptables to allow port 21 traffic, one must edit
/etc/sysconfig/iptables and
/etc/sysconfig/ip6tables (if IPv6 is in use).
Add the following line, ensuring that it appears before the final LOG and DROP lines for the INPUT chain:
-A INPUT -m state --state NEW -p tcp --dport 21 -j ACCEPTEdit the file /etc/sysconfig/iptables-config. Ensure that the space-separated list of modules contains
the FTP connection tracking module:
IPTABLES_MODULES="ip_conntrack_ftp" |
| Rationale | These settings configure the firewall to allow connections to an FTP server.
The first line allows initial connections to the FTP server port.
FTP is an older protocol which is not very compatible with firewalls. During the initial FTP dialogue, the client
and server negotiate an arbitrary port to be used for data transfer. The ip_conntrack_ftp module is used by
iptables to listen to that dialogue and allow connections to the data ports which FTP negotiates. This allows an
FTP server to operate on a system which is running a firewall. |
Uninstall httpd Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_httpd_removed |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_httpd_removed:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | unknown |
| Identifiers and References | Identifiers: CCE-85974-4 References: 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, 2.2.8 |
| Description |
The httpd package can be removed with the following command:
$ sudo dnf erase httpd |
| Rationale | If there is no need to make the web server software available,
removing it provides a safeguard against its activation. |
package httpd is removed oval:ssg-test_package_httpd_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_httpd_removed:obj:1 of type rpminfo_object
| Name |
|---|
| httpd |
Uninstall dovecot Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_dovecot_removed |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_dovecot_removed:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | unknown |
| Identifiers and References | Identifiers: CCE-85977-7 References: 2.2.9 |
| Description |
The dovecot package can be removed with the following command:
$ sudo dnf erase dovecot |
| Rationale | If there is no need to make the Dovecot software available,
removing it provides a safeguard against its activation. |
package dovecot is removed oval:ssg-test_package_dovecot_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_dovecot_removed:obj:1 of type rpminfo_object
| Name |
|---|
| dovecot |
Ensure LDAP client is not installed
| Rule ID | xccdf_org.ssgproject.content_rule_package_openldap-clients_removed |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_openldap-clients_removed:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | low |
| Identifiers and References | Identifiers: CCE-90831-9 |
| Description | The Lightweight Directory Access Protocol (LDAP) is a service that provides
a method for looking up information from a central database.
The openldap-clients package can be removed with the following command:
$ sudo dnf erase openldap-clients |
| Rationale | If the system does not need to act as an LDAP client, it is recommended that the software is removed to reduce the potential attack surface. |
package openldap-clients is removed oval:ssg-test_package_openldap-clients_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_openldap-clients_removed:obj:1 of type rpminfo_object
| Name |
|---|
| openldap-clients |
Disable Postfix Network Listening
| Rule ID | xccdf_org.ssgproject.content_rule_postfix_network_listening_disabled |
| Result | notapplicable |
| Multi-check rule | no |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-90825-1 References: BP28(R48), 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, CCI-000382, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, Req-2.2.4, 2.2.15 |
| Description | Edit the file /etc/postfix/main.cf to ensure that only the following
inet_interfaces line appears:
inet_interfaces = loopback-only |
| Rationale | This ensures postfix accepts mail messages
(such as cron job reports) from the local system only,
and not from the network, which protects it from network attack. |
Disable rpcbind Service
| Rule ID | xccdf_org.ssgproject.content_rule_service_rpcbind_disabled |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_rpcbind_disabled:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | low |
| Identifiers and References | Identifiers: CCE-84245-0 References: 2.2.17 |
| Description | The rpcbind utility maps RPC services to the ports on which they listen.
RPC processes notify rpcbind when they start, registering the ports they
are listening on and the RPC program numbers they expect to serve. The
rpcbind service redirects the client to the proper port number so it can
communicate with the requested service. If the system does not require RPC
(such as for NFS servers) then this service should be disabled.
The rpcbind service can be disabled with the following command:
$ sudo systemctl mask --now rpcbind.service |
| Rationale | If the system does not require rpc based services, it is recommended that
rpcbind be disabled to reduce the attack surface. |
package nfs-utils is removed oval:ssg-test_service_rpcbind_package_nfs-utils_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_service_rpcbind_package_nfs-utils_removed:obj:1 of type rpminfo_object
| Name |
|---|
| nfs-utils |
Test that the rpcbind service is not running oval:ssg-test_service_not_running_rpcbind:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_not_running_rpcbind:obj:1 of type systemdunitproperty_object
| Unit | Property |
|---|---|
| ^rpcbind\.(service|socket)$ | ActiveState |
Test that the property LoadState from the service rpcbind is masked oval:ssg-test_service_loadstate_is_masked_rpcbind:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_rpcbind:obj:1 of type systemdunitproperty_object
| Unit | Property |
|---|---|
| ^rpcbind\.(service|socket)$ | LoadState |
Disable Network File System (nfs)
| Rule ID | xccdf_org.ssgproject.content_rule_service_nfs_disabled |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-service_nfs_disabled:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | unknown |
| Identifiers and References | Identifiers: CCE-90850-9 References: 11, 12, 14, 15, 16, 18, 3, 5, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.03, DSS06.06, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CM-7(a), CM-7(b), CM-6(a), PR.AC-4, PR.AC-6, PR.PT-3, 2.2.16 |
| Description | The Network File System (NFS) service allows remote hosts to mount
and interact with shared filesystems on the local system. If the local system
is not designated as a NFS server then this service should be disabled.
The nfs-server service can be disabled with the following command:
$ sudo systemctl mask --now nfs-server.service |
| Rationale | Unnecessary services should be disabled to decrease the attack surface of the system. |
package nfs-utils is removed oval:ssg-test_service_nfs-server_package_nfs-utils_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_service_nfs-server_package_nfs-utils_removed:obj:1 of type rpminfo_object
| Name |
|---|
| nfs-utils |
Test that the nfs-server service is not running oval:ssg-test_service_not_running_nfs-server:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_not_running_nfs-server:obj:1 of type systemdunitproperty_object
| Unit | Property |
|---|---|
| ^nfs-server\.(service|socket)$ | ActiveState |
Test that the property LoadState from the service nfs-server is masked oval:ssg-test_service_loadstate_is_masked_nfs-server:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_service_loadstate_is_masked_nfs-server:obj:1 of type systemdunitproperty_object
| Unit | Property |
|---|---|
| ^nfs-server\.(service|socket)$ | LoadState |
The Chrony package is installed
| Rule ID | xccdf_org.ssgproject.content_rule_package_chrony_installed |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_chrony_installed:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84215-3 References: BP28(R43), 0988, 1405, FMT_SMF_EXT.1, Req-10.6.1, SRG-OS-000355-GPOS-00143, 2.1.1 |
| Description | System time should be synchronized between all systems in an environment. This is
typically done by establishing an authoritative time server or set of servers and having all
systems synchronize their clocks to them.
The chrony package can be installed with the following command:
$ sudo dnf install chrony |
| Rationale | Time synchronization is important to support time sensitive security mechanisms like
Kerberos and also ensures log files have consistent time records across the enterprise,
which aids in forensic investigations. |
package chrony is installed oval:ssg-test_package_chrony_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| chrony | x86_64 | (none) | 1.el9 | 4.3 | 0:4.3-1.el9 | 199e2f91fd431d51 | chrony-0:4.3-1.el9.x86_64 |
Ensure that chronyd is running under chrony user account
| Rule ID | xccdf_org.ssgproject.content_rule_chronyd_run_as_chrony_user |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-chronyd_run_as_chrony_user:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84108-0 References: 2.1.2 |
| Description | chrony is a daemon which implements the Network Time Protocol (NTP). It is designed to
synchronize system clocks across a variety of systems and use a source that is highly
accurate. More information on chrony can be found at
http://chrony.tuxfamily.org/.
Chrony can be configured to be a client and/or a server.
To ensure that chronyd is running under chrony user account,
remove any -u ... option from OPTIONS other than -u chrony,
as chrony is run under its own user by default.
This recommendation only applies if chrony is in use on the system. |
| Rationale | If chrony is in use on the system proper configuration is vital to ensuring time synchronization
is working properly. |
The default chrony user hasn't been overriden oval:ssg-test_no_user_override:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_user_override:obj:1 of type textfilecontent54_object
| Behaviors | Filepath | Pattern | Instance |
|---|---|---|---|
| no value | /etc/sysconfig/chronyd | ^\s*OPTIONS=.*[\s'"]-u(?!\s*chrony\b).* | 0 |
A remote time server for Chrony is configured
| Rule ID | xccdf_org.ssgproject.content_rule_chronyd_specify_remote_server |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-chronyd_specify_remote_server:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84218-7 References: BP28(R43), CCI-000160, CCI-001891, 0988, 1405, CM-6(a), AU-8(1)(a), Req-10.4.3, 2.1.2 |
| Description | Chrony is a daemon which implements the Network Time Protocol (NTP). It is designed to
synchronize system clocks across a variety of systems and use a source that is highly
accurate. More information on chrony can be found at
http://chrony.tuxfamily.org/.
Chrony can be configured to be a client and/or a server.
Add or edit server or pool lines to /etc/chrony.conf as appropriate:
server <remote-server>Multiple servers may be configured. |
| Rationale | If chrony is in use on the system proper configuration is vital to ensuring time
synchronization is working properly. |
Ensure at least one NTP server is set oval:ssg-test_chronyd_remote_server:tst:1 true
Following items have been found on the system:
| Path | Content |
|---|---|
| /etc/chrony.conf | pool 2.rhel.pool.ntp.org iburst |
Remove Rsh Trust Files
| Rule ID | xccdf_org.ssgproject.content_rule_no_rsh_trust_files |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-no_rsh_trust_files:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | high |
| Identifiers and References | Identifiers: CCE-84145-2 References: 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, CCI-001436, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4, 6.2.15 |
| Description | The files /etc/hosts.equiv and ~/.rhosts (in
each user's home directory) list remote hosts and users that are trusted by the
local system when using the rshd daemon.
To remove these files, run the following command to delete them from any
location:
$ sudo rm /etc/hosts.equiv $ rm ~/.rhosts |
| Rationale | This action is only meaningful if .rhosts support is permitted
through PAM. Trust files are convenient, but when used in conjunction with
the R-services, they can allow unauthenticated access to a system. |
look for .rhosts in /root oval:ssg-test_no_rsh_trust_files_root:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_no_rsh_trust_files_root:obj:1 of type file_object
| Path | Filename |
|---|---|
| /root | ^\.rhosts$ |
look for .rhosts in /home oval:ssg-test_no_rsh_trust_files_home:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_no_rsh_trust_files_home:obj:1 of type file_object
| Behaviors | Path | Filename |
|---|---|---|
| no value | /home | ^\.rhosts$ |
look for /etc/hosts.equiv oval:ssg-test_no_rsh_trust_files_etc:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_no_rsh_trust_files_etc:obj:1 of type file_object
| Path | Filename |
|---|---|
| /etc | ^hosts\.equiv$ |
Uninstall telnet-server Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_telnet-server_removed |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_telnet-server_removed:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | high |
| Identifiers and References | Identifiers: CCE-84149-4 References: BP28(R1), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, CCI-000381, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4, Req-2.2.4, SRG-OS-000095-GPOS-00049, 2.2.13 |
| Description | The telnet-server package can be removed with the following command:
$ sudo dnf erase telnet-server |
| Rationale | It is detrimental for operating systems to provide, or install by default,
functionality exceeding requirements or mission objectives. These
unnecessary capabilities are often overlooked and therefore may remain
unsecure. They increase the risk to the platform by providing additional
attack vectors.
The telnet service provides an unencrypted remote access service which does not provide for the confidentiality and integrity of user passwords or the remote session. If a privileged user were to login using this service, the privileged user password could be compromised. Removing the telnet-server package decreases the risk of the
telnet service's accidental (or intentional) activation. |
package telnet-server is removed oval:ssg-test_package_telnet-server_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_telnet-server_removed:obj:1 of type rpminfo_object
| Name |
|---|
| telnet-server |
Remove telnet Clients
| Rule ID | xccdf_org.ssgproject.content_rule_package_telnet_removed |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_telnet_removed:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | low |
| Identifiers and References | Identifiers: CCE-84146-0 References: BP28(R1), 3.1.13, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), A.8.2.3, A.13.1.1, A.13.2.1, A.13.2.3, A.14.1.2, A.14.1.3, 2.3.1 |
| Description | The telnet client allows users to start connections to other systems via
the telnet protocol. |
| Rationale | The telnet protocol is insecure and unencrypted. The use
of an unencrypted transmission medium could allow an unauthorized user
to steal credentials. The ssh package provides an
encrypted session and stronger security and is included in Red Hat Enterprise Linux 9. |
package telnet is removed oval:ssg-test_package_telnet_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_telnet_removed:obj:1 of type rpminfo_object
| Name |
|---|
| telnet |
Uninstall tftp-server Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_tftp-server_removed |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_tftp-server_removed:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | high |
| Identifiers and References | Identifiers: CCE-84154-4 References: BP28(R1), 11, 12, 14, 15, 3, 8, 9, APO13.01, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS01.04, DSS05.02, DSS05.03, DSS05.05, DSS06.06, CCI-000318, CCI-000366, CCI-000368, CCI-001812, CCI-001813, CCI-001814, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 3.1, SR 3.5, SR 3.8, SR 4.1, SR 4.3, SR 5.1, SR 5.2, SR 5.3, SR 7.1, SR 7.6, A.11.2.6, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.2.1, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.2.1, A.6.2.2, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.AC-3, PR.IP-1, PR.PT-3, PR.PT-4, SRG-OS-000480-GPOS-00227, 2.2.7 |
| Description | The tftp-server package can be removed with the following command: $ sudo dnf erase tftp-server |
| Rationale | Removing the tftp-server package decreases the risk of the accidental
(or intentional) activation of tftp services.
If TFTP is required for operational support (such as transmission of router configurations), its use must be documented with the Information Systems Securty Manager (ISSM), restricted to only authorized personnel, and have access control rules established. |
package tftp-server is removed oval:ssg-test_package_tftp-server_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_tftp-server_removed:obj:1 of type rpminfo_object
| Name |
|---|
| tftp-server |
Remove tftp Daemon
| Rule ID | xccdf_org.ssgproject.content_rule_package_tftp_removed |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_tftp_removed:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | low |
| Identifiers and References | Identifiers: CCE-84153-6 |
| Description | Trivial File Transfer Protocol (TFTP) is a simple file transfer protocol,
typically used to automatically transfer configuration or boot files between systems.
TFTP does not support authentication and can be easily hacked. The package
tftp is a client program that allows for connections to a tftp server. |
| Rationale | It is recommended that TFTP be removed, unless there is a specific need
for TFTP (such as a boot server). In that case, use extreme caution when configuring
the services. |
package tftp is removed oval:ssg-test_package_tftp_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_tftp_removed:obj:1 of type rpminfo_object
| Name |
|---|
| tftp |
Uninstall rsync Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_rsync_removed |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_rsync_removed:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-86336-5 References: 2.2.18 |
| Description | The rsyncd service can be used to synchronize files between systems over network links.
The rsync-daemon package can be removed with the following command:
$ sudo dnf erase rsync-daemon |
| Rationale | The rsyncd service presents a security risk as it uses unencrypted protocols for
communication. |
package rsync-daemon is removed oval:ssg-test_package_rsync-daemon_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_rsync-daemon_removed:obj:1 of type rpminfo_object
| Name |
|---|
| rsync-daemon |
Uninstall CUPS Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_cups_removed |
| Result | fail |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_cups_removed:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | unknown |
| Identifiers and References | Identifiers: CCE-86300-1 References: 11, 14, 3, 9, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.05, DSS06.06, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.9.1.2, CM-7(a), CM-7(b), CM-6(a), PR.IP-1, PR.PT-3, 2.2.3 |
| Description | The cups package can be removed with the following command:
$ sudo dnf erase cups |
| Rationale | If the system does not need to print jobs or accept print jobs from other systems, it is
recommended that CUPS be removed to reduce the potential attack surface. |
package cups is removed oval:ssg-test_package_cups_removed:tst:1 false
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| cups | x86_64 | 1 | 16.el9 | 2.3.3op2 | 1:2.3.3op2-16.el9 | 199e2f91fd431d51 | cups-1:2.3.3op2-16.el9.x86_64 |
Uninstall squid Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_squid_removed |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_squid_removed:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | unknown |
| Identifiers and References | Identifiers: CCE-84238-5 References: 2.2.11 |
| Description | The squid package can be removed with the following command: $ sudo dnf erase squid |
| Rationale | If there is no need to make the proxy server software available,
removing it provides a safeguard against its activation. |
package squid is removed oval:ssg-test_package_squid_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_squid_removed:obj:1 of type rpminfo_object
| Name |
|---|
| squid |
Uninstall Samba Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_samba_removed |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_samba_removed:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | unknown |
| Identifiers and References | Identifiers: CCE-85979-3 References: 2.2.10 |
| Description | The samba package can be removed with the following command: $ sudo dnf erase samba |
| Rationale | If there is no need to make the Samba software available,
removing it provides a safeguard against its activation. |
package samba is removed oval:ssg-test_package_samba_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_samba_removed:obj:1 of type rpminfo_object
| Name |
|---|
| samba |
Uninstall net-snmp Package
| Rule ID | xccdf_org.ssgproject.content_rule_package_net-snmp_removed |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-package_net-snmp_removed:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | unknown |
| Identifiers and References | Identifiers: CCE-85981-9 References: 2.2.12 |
| Description |
The net-snmp package provides the snmpd service.
The net-snmp package can be removed with the following command:
$ sudo dnf erase net-snmp |
| Rationale | If there is no need to run SNMP server software,
removing the package provides a safeguard against its
activation. |
package net-snmp is removed oval:ssg-test_package_net-snmp_removed:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-obj_test_package_net-snmp_removed:obj:1 of type rpminfo_object
| Name |
|---|
| net-snmp |
Set SSH Client Alive Count Max
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_set_keepalive |
| Result | error |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_set_keepalive:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-90805-3 References: BP28(R29), 1, 12, 13, 14, 15, 16, 18, 3, 5, 7, 8, 5.5.6, APO13.01, BAI03.01, BAI03.02, BAI03.03, DSS01.03, DSS03.05, DSS05.04, DSS05.05, DSS05.07, DSS05.10, DSS06.03, DSS06.10, 3.1.11, CCI-000879, CCI-001133, CCI-002361, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 6.2, A.12.4.1, A.12.4.3, A.14.1.1, A.14.2.1, A.14.2.5, A.18.1.4, A.6.1.2, A.6.1.5, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.2, A.9.2.3, A.9.2.4, A.9.2.6, A.9.3.1, A.9.4.1, A.9.4.2, A.9.4.3, A.9.4.4, A.9.4.5, CIP-004-6 R2.2.3, CIP-007-3 R5.1, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, AC-2(5), AC-12, AC-17(a), SC-10, CM-6(a), DE.CM-1, DE.CM-3, PR.AC-1, PR.AC-4, PR.AC-6, PR.AC-7, PR.IP-2, Req-8.1.8, SRG-OS-000163-GPOS-00072, SRG-OS-000279-GPOS-00109, SRG-OS-000480-VMM-002000, 5.2.20 |
| Description | The SSH server sends at most ClientAliveCountMax messages
during a SSH session and waits for a response from the SSH client.
The option ClientAliveInterval configures timeout after
each ClientAliveCountMax message. If the SSH server does not
receive a response from the client, then the connection is considered unresponsive
and terminated.
For SSH earlier than v8.2, a ClientAliveCountMax value of 0
causes a timeout precisely when the ClientAliveInterval is set.
Starting with v8.2, a value of 0 disables the timeout functionality
completely. If the option is set to a number greater than 0, then
the session will be disconnected after
ClientAliveInterval * ClientAliveCountMax seconds without receiving
a keep alive message. |
| Rationale | This ensures a user login will be terminated as soon as the ClientAliveInterval
is reached. |
Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| openssh-server | x86_64 | (none) | 28.el9 | 8.7p1 | 0:8.7p1-28.el9 | 199e2f91fd431d51 | openssh-server-0:8.7p1-28.el9.x86_64 |
Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| openssh-server | x86_64 | (none) | 28.el9 | 8.7p1 | 0:8.7p1-28.el9 | 199e2f91fd431d51 | openssh-server-0:8.7p1-28.el9.x86_64 |
Check the value of ClientAliveCountMax setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_set_keepalive_clientalivecountmax:tst:1 error
No items have been found conforming to the following objects:
Object oval:ssg-object_sshd_set_keepalive_clientalivecountmax:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/ssh/sshd_config | ^[\s]*(?i)ClientAliveCountMax[\s]+([\d]+)[\s]*(?:#.*)?$ | 1 |
Check the value of ClientAliveCountMax setting in /etc/ssh/sshd_config.d/ files oval:ssg-test_sshd_set_keepalive_clientalivecountmax_dir:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-object_sshd_set_keepalive_clientalivecountmax_dir:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/ssh/sshd_config.d | .*\.conf$ | ^[\s]*(?i)ClientAliveCountMax[\s]+([\d]+)[\s]*(?:#.*)?$ | 1 |
Disable Host-Based Authentication
| Rule ID | xccdf_org.ssgproject.content_rule_disable_host_auth |
| Result | error |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-disable_host_auth:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-90816-0 References: 11, 12, 14, 15, 16, 18, 3, 5, 9, 5.5.6, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.03, DSS06.06, 3.1.12, CCI-000366, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.2.3, CIP-004-6 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.2, CIP-007-3 R5.2, CIP-007-3 R5.3.1, CIP-007-3 R5.3.2, CIP-007-3 R5.3.3, AC-3, AC-17(a), CM-7(a), CM-7(b), CM-6(a), PR.AC-4, PR.AC-6, PR.IP-1, PR.PT-3, FIA_UAU.1, SRG-OS-000480-GPOS-00229, SRG-OS-000480-VMM-002000, 5.2.8 |
| Description | SSH's cryptographic host-based authentication is
more secure than .rhosts authentication. However, it is
not recommended that hosts unilaterally trust one another, even
within an organization.
The default SSH configuration disables host-based authentication. The appropriate configuration is used if no value is set for HostbasedAuthentication.
To explicitly disable host-based authentication, add or correct the following line in /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf:
HostbasedAuthentication no |
| Rationale | SSH trust relationships mean a compromise on one host
can allow an attacker to move trivially to other hosts. |
Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| openssh-server | x86_64 | (none) | 28.el9 | 8.7p1 | 0:8.7p1-28.el9 | 199e2f91fd431d51 | openssh-server-0:8.7p1-28.el9.x86_64 |
Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| openssh-server | x86_64 | (none) | 28.el9 | 8.7p1 | 0:8.7p1-28.el9 | 199e2f91fd431d51 | openssh-server-0:8.7p1-28.el9.x86_64 |
tests the value of HostbasedAuthentication setting in the /etc/ssh/sshd_config file oval:ssg-test_disable_host_auth:tst:1 error
No items have been found conforming to the following objects:
Object oval:ssg-obj_disable_host_auth:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/ssh/sshd_config | ^[ \t]*(?i)HostbasedAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#) | 1 |
tests the value of HostbasedAuthentication setting in the /etc/ssh/sshd_config.d file oval:ssg-test_disable_host_auth_config_dir:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_disable_host_auth_config_dir:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/ssh/sshd_config.d | .*\.conf$ | ^[ \t]*(?i)HostbasedAuthentication(?-i)[ \t]+(.+?)[ \t]*(?:$|#) | 1 |
Disable SSH Access via Empty Passwords
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_disable_empty_passwords |
| Result | error |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_disable_empty_passwords:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | high |
| Identifiers and References | Identifiers: CCE-90799-8 References: NT007(R17), 11, 12, 13, 14, 15, 16, 18, 3, 5, 9, 5.5.6, APO01.06, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.02, DSS06.03, DSS06.06, 3.1.1, 3.1.5, CCI-000366, CCI-000766, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 5.2, SR 7.6, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.12.1.2, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, AC-17(a), CM-7(a), CM-7(b), CM-6(a), PR.AC-4, PR.AC-6, PR.DS-5, PR.IP-1, PR.PT-3, FIA_UAU.1, Req-2.2.6, SRG-OS-000106-GPOS-00053, SRG-OS-000480-GPOS-00229, SRG-OS-000480-GPOS-00227, SRG-OS-000480-VMM-002000, 5.2.9 |
| Description | Disallow SSH login with empty passwords.
The default SSH configuration disables logins with empty passwords. The appropriate
configuration is used if no value is set for PermitEmptyPasswords.
To explicitly disallow SSH login from accounts with empty passwords, add or correct the following line in /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf:
PermitEmptyPasswords noAny accounts with empty passwords should be disabled immediately, and PAM configuration should prevent users from being able to assign themselves empty passwords. |
| Rationale | Configuring this setting for the SSH daemon provides additional assurance
that remote login via SSH will require a password, even in the event of
misconfiguration elsewhere. |
Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| openssh-server | x86_64 | (none) | 28.el9 | 8.7p1 | 0:8.7p1-28.el9 | 199e2f91fd431d51 | openssh-server-0:8.7p1-28.el9.x86_64 |
Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| openssh-server | x86_64 | (none) | 28.el9 | 8.7p1 | 0:8.7p1-28.el9 | 199e2f91fd431d51 | openssh-server-0:8.7p1-28.el9.x86_64 |
tests the value of PermitEmptyPasswords setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_disable_empty_passwords:tst:1 error
No items have been found conforming to the following objects:
Object oval:ssg-obj_sshd_disable_empty_passwords:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/ssh/sshd_config | ^[ \t]*(?i)PermitEmptyPasswords(?-i)[ \t]+(.+?)[ \t]*(?:$|#) | 1 |
tests the value of PermitEmptyPasswords setting in the /etc/ssh/sshd_config.d file oval:ssg-test_sshd_disable_empty_passwords_config_dir:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_sshd_disable_empty_passwords_config_dir:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/ssh/sshd_config.d | .*\.conf$ | ^[ \t]*(?i)PermitEmptyPasswords(?-i)[ \t]+(.+?)[ \t]*(?:$|#) | 1 |
Disable SSH Support for .rhosts Files
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_disable_rhosts |
| Result | error |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_disable_rhosts:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-90797-2 References: 11, 12, 14, 15, 16, 18, 3, 5, 9, 5.5.6, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS05.02, DSS05.04, DSS05.05, DSS05.07, DSS06.03, DSS06.06, 3.1.12, CCI-000366, 4.3.3.2.2, 4.3.3.5.1, 4.3.3.5.2, 4.3.3.5.3, 4.3.3.5.4, 4.3.3.5.5, 4.3.3.5.6, 4.3.3.5.7, 4.3.3.5.8, 4.3.3.6.1, 4.3.3.6.2, 4.3.3.6.3, 4.3.3.6.4, 4.3.3.6.5, 4.3.3.6.6, 4.3.3.6.7, 4.3.3.6.8, 4.3.3.6.9, 4.3.3.7.1, 4.3.3.7.2, 4.3.3.7.3, 4.3.3.7.4, 4.3.4.3.2, 4.3.4.3.3, SR 1.1, SR 1.10, SR 1.11, SR 1.12, SR 1.13, SR 1.2, SR 1.3, SR 1.4, SR 1.5, SR 1.6, SR 1.7, SR 1.8, SR 1.9, SR 2.1, SR 2.2, SR 2.3, SR 2.4, SR 2.5, SR 2.6, SR 2.7, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, A.6.1.2, A.7.1.1, A.9.1.2, A.9.2.1, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, AC-17(a), CM-7(a), CM-7(b), CM-6(a), PR.AC-4, PR.AC-6, PR.IP-1, PR.PT-3, FIA_UAU.1, SRG-OS-000480-GPOS-00227, SRG-OS-000107-VMM-000530, 5.2.11 |
| Description | SSH can emulate the behavior of the obsolete rsh
command in allowing users to enable insecure access to their
accounts via .rhosts files.
The default SSH configuration disables support for .rhosts. The appropriate
configuration is used if no value is set for IgnoreRhosts.
To explicitly disable support for .rhosts files, add or correct the following line in /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf:
IgnoreRhosts yes |
| Rationale | SSH trust relationships mean a compromise on one host
can allow an attacker to move trivially to other hosts. |
Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| openssh-server | x86_64 | (none) | 28.el9 | 8.7p1 | 0:8.7p1-28.el9 | 199e2f91fd431d51 | openssh-server-0:8.7p1-28.el9.x86_64 |
Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| openssh-server | x86_64 | (none) | 28.el9 | 8.7p1 | 0:8.7p1-28.el9 | 199e2f91fd431d51 | openssh-server-0:8.7p1-28.el9.x86_64 |
tests the value of IgnoreRhosts setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_disable_rhosts:tst:1 error
No items have been found conforming to the following objects:
Object oval:ssg-obj_sshd_disable_rhosts:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/ssh/sshd_config | ^[ \t]*(?i)IgnoreRhosts(?-i)[ \t]+(.+?)[ \t]*(?:$|#) | 1 |
tests the value of IgnoreRhosts setting in the /etc/ssh/sshd_config.d file oval:ssg-test_sshd_disable_rhosts_config_dir:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_sshd_disable_rhosts_config_dir:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/ssh/sshd_config.d | .*\.conf$ | ^[ \t]*(?i)IgnoreRhosts(?-i)[ \t]+(.+?)[ \t]*(?:$|#) | 1 |
Disable SSH Root Login
Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| openssh-server | x86_64 | (none) | 28.el9 | 8.7p1 | 0:8.7p1-28.el9 | 199e2f91fd431d51 | openssh-server-0:8.7p1-28.el9.x86_64 |
Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| openssh-server | x86_64 | (none) | 28.el9 | 8.7p1 | 0:8.7p1-28.el9 | 199e2f91fd431d51 | openssh-server-0:8.7p1-28.el9.x86_64 |
tests the value of PermitRootLogin setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_disable_root_login:tst:1 error
No items have been found conforming to the following objects:
Object oval:ssg-obj_sshd_disable_root_login:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/ssh/sshd_config | ^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+(.+?)[ \t]*(?:$|#) | 1 |
tests the value of PermitRootLogin setting in the /etc/ssh/sshd_config.d file oval:ssg-test_sshd_disable_root_login_config_dir:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_sshd_disable_root_login_config_dir:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/ssh/sshd_config.d | .*\.conf$ | ^[ \t]*(?i)PermitRootLogin(?-i)[ \t]+(.+?)[ \t]*(?:$|#) | 1 |
Do Not Allow SSH Environment Options
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_do_not_permit_user_env |
| Result | error |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_do_not_permit_user_env:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-90803-8 References: 11, 3, 9, 5.5.6, BAI10.01, BAI10.02, BAI10.03, BAI10.05, 3.1.12, CCI-000366, 164.308(a)(4)(i), 164.308(b)(1), 164.308(b)(3), 164.310(b), 164.312(e)(1), 164.312(e)(2)(ii), 4.3.4.3.2, 4.3.4.3.3, SR 7.6, A.12.1.2, A.12.5.1, A.12.6.2, A.14.2.2, A.14.2.3, A.14.2.4, AC-17(a), CM-7(a), CM-7(b), CM-6(a), PR.IP-1, Req-2.2.6, SRG-OS-000480-GPOS-00229, SRG-OS-000480-VMM-002000, 5.2.10 |
| Description | Ensure that users are not able to override environment variables of the SSH daemon.
The default SSH configuration disables environment processing. The appropriate configuration is used if no value is set for PermitUserEnvironment.
To explicitly disable Environment options, add or correct the following /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf:
PermitUserEnvironment no |
| Rationale | SSH environment options potentially allow users to bypass
access restriction in some configurations. |
Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| openssh-server | x86_64 | (none) | 28.el9 | 8.7p1 | 0:8.7p1-28.el9 | 199e2f91fd431d51 | openssh-server-0:8.7p1-28.el9.x86_64 |
Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| openssh-server | x86_64 | (none) | 28.el9 | 8.7p1 | 0:8.7p1-28.el9 | 199e2f91fd431d51 | openssh-server-0:8.7p1-28.el9.x86_64 |
tests the value of PermitUserEnvironment setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_do_not_permit_user_env:tst:1 error
No items have been found conforming to the following objects:
Object oval:ssg-obj_sshd_do_not_permit_user_env:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/ssh/sshd_config | ^[ \t]*(?i)PermitUserEnvironment(?-i)[ \t]+(.+?)[ \t]*(?:$|#) | 1 |
tests the value of PermitUserEnvironment setting in the /etc/ssh/sshd_config.d file oval:ssg-test_sshd_do_not_permit_user_env_config_dir:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_sshd_do_not_permit_user_env_config_dir:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/ssh/sshd_config.d | .*\.conf$ | ^[ \t]*(?i)PermitUserEnvironment(?-i)[ \t]+(.+?)[ \t]*(?:$|#) | 1 |
Enable PAM
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_enable_pam |
| Result | error |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_enable_pam:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-86722-6 References: CCI-000877, SRG-OS-000125-GPOS-00065, 5.2.6 |
| Description | UsePAM Enables the Pluggable Authentication Module interface. If set to “yes” this will
enable PAM authentication using ChallengeResponseAuthentication and
PasswordAuthentication in addition to PAM account and session module processing for all
authentication types.
To enable PAM authentication, add or correct the following line in
/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf:
UsePAM yes |
| Rationale | When UsePAM is set to yes, PAM runs through account and session types properly. This is
important if you want to restrict access to services based off of IP, time or other factors of
the account. Additionally, you can make sure users inherit certain environment variables
on login or disallow access to the server. |
Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| openssh-server | x86_64 | (none) | 28.el9 | 8.7p1 | 0:8.7p1-28.el9 | 199e2f91fd431d51 | openssh-server-0:8.7p1-28.el9.x86_64 |
Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| openssh-server | x86_64 | (none) | 28.el9 | 8.7p1 | 0:8.7p1-28.el9 | 199e2f91fd431d51 | openssh-server-0:8.7p1-28.el9.x86_64 |
tests the value of UsePAM setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_enable_pam:tst:1 error
No items have been found conforming to the following objects:
Object oval:ssg-obj_sshd_enable_pam:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/ssh/sshd_config | ^[ \t]*(?i)UsePAM(?-i)[ \t]+(.+?)[ \t]*(?:$|#) | 1 |
tests the value of UsePAM setting in the /etc/ssh/sshd_config.d file oval:ssg-test_sshd_enable_pam_config_dir:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_sshd_enable_pam_config_dir:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/ssh/sshd_config.d | .*\.conf$ | ^[ \t]*(?i)UsePAM(?-i)[ \t]+(.+?)[ \t]*(?:$|#) | 1 |
Enable Encrypted X11 Forwarding
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_enable_x11_forwarding |
| Result | error |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_enable_x11_forwarding:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | high |
| Identifiers and References | Identifiers: CCE-89696-9 References: 1, 11, 12, 13, 15, 16, 18, 20, 3, 4, 6, 9, BAI03.08, BAI07.04, BAI10.01, BAI10.02, BAI10.03, BAI10.05, DSS03.01, 3.1.13, CCI-000366, 4.3.4.3.2, 4.3.4.3.3, 4.4.3.3, SR 7.6, A.12.1.1, A.12.1.2, A.12.1.4, A.12.5.1, A.12.6.2, A.13.1.1, A.13.1.2, A.14.2.2, A.14.2.3, A.14.2.4, CIP-007-3 R7.1, CM-6(a), AC-17(a), AC-17(2), DE.AE-1, PR.DS-7, PR.IP-1, SRG-OS-000480-GPOS-00227 |
| Description | By default, remote X11 connections are not encrypted when initiated
by users. SSH has the capability to encrypt remote X11 connections when SSH's
X11Forwarding option is enabled.
To enable X11 Forwarding, add or correct the following line in /etc/ssh/sshd_config.d/00-complianceascode-hardening.conf:
X11Forwarding yes |
| Rationale | Non-encrypted X displays allow an attacker to capture keystrokes and to execute commands
remotely. |
Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| openssh-server | x86_64 | (none) | 28.el9 | 8.7p1 | 0:8.7p1-28.el9 | 199e2f91fd431d51 | openssh-server-0:8.7p1-28.el9.x86_64 |
Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| openssh-server | x86_64 | (none) | 28.el9 | 8.7p1 | 0:8.7p1-28.el9 | 199e2f91fd431d51 | openssh-server-0:8.7p1-28.el9.x86_64 |
tests the value of X11Forwarding setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_enable_x11_forwarding:tst:1 error
No items have been found conforming to the following objects:
Object oval:ssg-obj_sshd_enable_x11_forwarding:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/ssh/sshd_config | ^[ \t]*(?i)X11Forwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#) | 1 |
tests the value of X11Forwarding setting in the /etc/ssh/sshd_config.d file oval:ssg-test_sshd_enable_x11_forwarding_config_dir:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_sshd_enable_x11_forwarding_config_dir:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/ssh/sshd_config.d | .*\.conf$ | ^[ \t]*(?i)X11Forwarding(?-i)[ \t]+(.+?)[ \t]*(?:$|#) | 1 |
Ensure SSH LoginGraceTime is configured
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_set_login_grace_time |
| Result | error |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_set_login_grace_time:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-86552-7 References: 5.2.19 |
| Description | The LoginGraceTime parameter to the SSH server specifies the time allowed for successful authentication to
the SSH server. The longer the Grace period is the more open unauthenticated connections
can exist. Like other session controls in this session the Grace Period should be limited to
appropriate limits to ensure the service is available for needed access. |
| Rationale | Setting the LoginGraceTime parameter to a low number will minimize the risk of successful
brute force attacks to the SSH server. It will also limit the number of concurrent
unauthenticated connections. |
Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| openssh-server | x86_64 | (none) | 28.el9 | 8.7p1 | 0:8.7p1-28.el9 | 199e2f91fd431d51 | openssh-server-0:8.7p1-28.el9.x86_64 |
Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| openssh-server | x86_64 | (none) | 28.el9 | 8.7p1 | 0:8.7p1-28.el9 | 199e2f91fd431d51 | openssh-server-0:8.7p1-28.el9.x86_64 |
LoginGraceTime is configured oval:ssg-test_sshd_login_grace_time:tst:1 error
No items have been found conforming to the following objects:
Object oval:ssg-object_sshd_login_grace_time:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/ssh/sshd_config | ^[\s]*(?i)LoginGraceTime[\s]+(\d+)[\s]*(?:#.*)?$ | 1 |
Set SSH Daemon LogLevel to VERBOSE
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_set_loglevel_verbose |
| Result | error |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_set_loglevel_verbose:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-86923-0 References: CCI-000067, CIP-007-3 R7.1, AC-17(a), AC-17(1), CM-6(a), Req-2.2.6, SRG-OS-000032-GPOS-00013, 5.2.5 |
| Description | The VERBOSE parameter configures the SSH daemon to record login and logout activity.
To specify the log level in
SSH, add or correct the following line in
/etc/ssh/sshd_config.d/00-complianceascode-hardening.conf:
LogLevel VERBOSE |
| Rationale | SSH provides several logging levels with varying amounts of verbosity. DEBUG is specifically
not recommended other than strictly for debugging SSH communications since it provides
so much data that it is difficult to identify important security information. INFO or
VERBOSE level is the basic level that only records login activity of SSH users. In many
situations, such as Incident Response, it is important to determine when a particular user was active
on a system. The logout record can eliminate those users who disconnected, which helps narrow the
field. |
Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| openssh-server | x86_64 | (none) | 28.el9 | 8.7p1 | 0:8.7p1-28.el9 | 199e2f91fd431d51 | openssh-server-0:8.7p1-28.el9.x86_64 |
Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| openssh-server | x86_64 | (none) | 28.el9 | 8.7p1 | 0:8.7p1-28.el9 | 199e2f91fd431d51 | openssh-server-0:8.7p1-28.el9.x86_64 |
tests the value of LogLevel setting in the /etc/ssh/sshd_config file oval:ssg-test_sshd_set_loglevel_verbose:tst:1 error
No items have been found conforming to the following objects:
Object oval:ssg-obj_sshd_set_loglevel_verbose:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/ssh/sshd_config | ^[ \t]*(?i)LogLevel(?-i)[ \t]+(.+?)[ \t]*(?:$|#) | 1 |
tests the value of LogLevel setting in the /etc/ssh/sshd_config.d file oval:ssg-test_sshd_set_loglevel_verbose_config_dir:tst:1 false
No items have been found conforming to the following objects:
Object oval:ssg-obj_sshd_set_loglevel_verbose_config_dir:obj:1 of type textfilecontent54_object
| Path | Filename | Pattern | Instance |
|---|---|---|---|
| /etc/ssh/sshd_config.d | .*\.conf$ | ^[ \t]*(?i)LogLevel(?-i)[ \t]+(.+?)[ \t]*(?:$|#) | 1 |
Set SSH authentication attempt limit
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_set_max_auth_tries |
| Result | error |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_set_max_auth_tries:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-90810-3 References: 0421, 0422, 0431, 0974, 1173, 1401, 1504, 1505, 1546, 1557, 1558, 1559, 1560, 1561, 5.2.16 |
| Description | The MaxAuthTries parameter specifies the maximum number of authentication attempts
permitted per connection. Once the number of failures reaches half this value, additional failures are logged.
to set MaxAUthTries edit /etc/ssh/sshd_config as follows:
MaxAuthTries 4 |
| Rationale | Setting the MaxAuthTries parameter to a low number will minimize the risk of successful
brute force attacks to the SSH server. |
Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| openssh-server | x86_64 | (none) | 28.el9 | 8.7p1 | 0:8.7p1-28.el9 | 199e2f91fd431d51 | openssh-server-0:8.7p1-28.el9.x86_64 |
Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| openssh-server | x86_64 | (none) | 28.el9 | 8.7p1 | 0:8.7p1-28.el9 | 199e2f91fd431d51 | openssh-server-0:8.7p1-28.el9.x86_64 |
maxauthtries is configured oval:ssg-test_sshd_max_auth_tries:tst:1 error
No items have been found conforming to the following objects:
Object oval:ssg-object_sshd_max_auth_tries:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/ssh/sshd_config | ^[\s]*(?i)MaxAuthTries[\s]+(\d+)[\s]*(?:#.*)?$ | 1 |
Set SSH MaxSessions limit
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_set_max_sessions |
| Result | error |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_set_max_sessions:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-84103-1 References: 5.2.18 |
| Description | The MaxSessions parameter specifies the maximum number of open sessions permitted
from a given connection. To set MaxSessions edit
/etc/ssh/sshd_config as follows: MaxSessions 10 |
| Rationale | To protect a system from denial of service due to a large number of concurrent
sessions, use the rate limiting function of MaxSessions to protect availability
of sshd logins and prevent overwhelming the daemon. |
Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| openssh-server | x86_64 | (none) | 28.el9 | 8.7p1 | 0:8.7p1-28.el9 | 199e2f91fd431d51 | openssh-server-0:8.7p1-28.el9.x86_64 |
Verify if Profile set Value sshd_required as required oval:ssg-test_sshd_required:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is installed oval:ssg-test_package_openssh-server_installed:tst:1 true
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| openssh-server | x86_64 | (none) | 28.el9 | 8.7p1 | 0:8.7p1-28.el9 | 199e2f91fd431d51 | openssh-server-0:8.7p1-28.el9.x86_64 |
maxsessions is configured oval:ssg-test_sshd_max_sessions:tst:1 error
No items have been found conforming to the following objects:
Object oval:ssg-object_sshd_max_sessions:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/ssh/sshd_config | ^[\s]*(?i)MaxSessions[\s]+(\d+)[\s]*(?:#.*)?$ | 1 |
Ensure SSH MaxStartups is configured
| Rule ID | xccdf_org.ssgproject.content_rule_sshd_set_maxstartups |
| Result | error |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-sshd_set_maxstartups:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-87872-8 References: 5.2.17 |
| Description | The MaxStartups parameter specifies the maximum number of concurrent
unauthenticated connections to the SSH daemon. Additional connections will be
dropped until authentication succeeds or the LoginGraceTime expires for a
connection. To confgure MaxStartups, you should add or correct the following
line in the
/etc/ssh/sshd_config file:
MaxStartups 10:30:60CIS recommends a MaxStartups value of '10:30:60', or more restrictive where dictated by site policy. |
| Rationale | To protect a system from denial of service due to a large number of pending
authentication connection attempts, use the rate limiting function of MaxStartups
to protect availability of sshd logins and prevent overwhelming the daemon. |
Verify if Profile set Value sshd_required as not required oval:ssg-test_sshd_not_required:tst:1 false
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
Verify if Value of sshd_required is the default oval:ssg-test_sshd_requirement_unset:tst:1 true
Following items have been found on the system:
| Var ref | Value |
|---|---|
| oval:ssg-sshd_required:var:1 | 0 |
package openssh-server is removed oval:ssg-test_package_openssh-server_removed:tst:1 false
Following items have been found on the system:
| Name | Arch | Epoch | Release | Version | Evr | Signature keyid | Extended name |
|---|---|---|---|---|---|---|---|
| openssh-server | x86_64 | (none) | 28.el9 | 8.7p1 | 0:8.7p1-28.el9 | 199e2f91fd431d51 | openssh-server-0:8.7p1-28.el9.x86_64 |
SSH MaxStartups start parameter is less than or equal to 10 oval:ssg-tst_maxstartups_start_parameter:tst:1 error
No items have been found conforming to the following objects:
Object oval:ssg-obj_sshd_config_maxstartups_first_parameter:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/ssh/sshd_config | (?i)^\s*MaxStartups\s+(\d+):\d+:\d+\s*$ | 1 |
SSH MaxStartups rate parameter is greater than or equal to 30 oval:ssg-tst_maxstartups_rate_parameter:tst:1 error
No items have been found conforming to the following objects:
Object oval:ssg-obj_sshd_config_maxstartups_second_parameter:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/ssh/sshd_config | (?i)^\s*MaxStartups\s+\d+:(\d+):\d+\s*$ | 1 |
SSH MaxStartups full parameter is less than or equal to 100 oval:ssg-tst_maxstartups_full_parameter:tst:1 error
No items have been found conforming to the following objects:
Object oval:ssg-obj_sshd_config_maxstartups_third_parameter:obj:1 of type textfilecontent54_object
| Filepath | Pattern | Instance |
|---|---|---|
| /etc/ssh/sshd_config | (?i)^\s*MaxStartups\s+\d+:\d+:(\d+)\s*$ | 1 |
Verify Group Who Owns SSH Server config file
| Rule ID | xccdf_org.ssgproject.content_rule_file_groupowner_sshd_config |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_groupowner_sshd_config:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-90817-8 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, AC-17(a), CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, SRG-OS-000480-GPOS-00227, 5.2.1 |
| Description |
To properly set the group owner of /etc/ssh/sshd_config, run the command:
$ sudo chgrp root /etc/ssh/sshd_config |
| Rationale | Service configuration files enable or disable features of their respective
services that if configured incorrectly can lead to insecure and vulnerable
configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes. |
Testing group ownership of /etc/ssh/sshd_config oval:ssg-test_file_groupowner_sshd_config_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_groupowner_sshd_config_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/ssh/sshd_config | oval:ssg-symlink_file_groupowner_sshd_config_uid_0:ste:1 | oval:ssg-state_file_groupowner_sshd_config_gid_0_0:ste:1 |
Verify Owner on SSH Server config file
| Rule ID | xccdf_org.ssgproject.content_rule_file_owner_sshd_config |
| Result | pass |
| Multi-check rule | no |
| OVAL Definition ID | oval:ssg-file_owner_sshd_config:def:1 |
| Time | 2023-07-10T14:11:29+05:00 |
| Severity | medium |
| Identifiers and References | Identifiers: CCE-90821-0 References: 12, 13, 14, 15, 16, 18, 3, 5, APO01.06, DSS05.04, DSS05.07, DSS06.02, 4.3.3.7.3, SR 2.1, SR 5.2, A.10.1.1, A.11.1.4, A.11.1.5, A.11.2.1, A.13.1.1, A.13.1.3, A.13.2.1, A.13.2.3, A.13.2.4, A.14.1.2, A.14.1.3, A.6.1.2, A.7.1.1, A.7.1.2, A.7.3.1, A.8.2.2, A.8.2.3, A.9.1.1, A.9.1.2, A.9.2.3, A.9.4.1, A.9.4.4, A.9.4.5, CIP-003-8 R5.1.1, CIP-003-8 R5.3, CIP-004-6 R2.3, CIP-007-3 R2.1, CIP-007-3 R2.2, CIP-007-3 R2.3, CIP-007-3 R5.1, CIP-007-3 R5.1.1, CIP-007-3 R5.1.2, AC-17(a), CM-6(a), AC-6(1), PR.AC-4, PR.DS-5, SRG-OS-000480-GPOS-00227, 5.2.1 |
| Description |
To properly set the owner of /etc/ssh/sshd_config, run the command:
$ sudo chown root /etc/ssh/sshd_config |
| Rationale | Service configuration files enable or disable features of their respective
services that if configured incorrectly can lead to insecure and vulnerable
configurations. Therefore, service configuration files should be owned by the
correct group to prevent unauthorized changes. |
Testing user ownership of /etc/ssh/sshd_config oval:ssg-test_file_owner_sshd_config_0:tst:1 true
No items have been found conforming to the following objects:
Object oval:ssg-object_file_owner_sshd_config_0:obj:1 of type file_object
| Filepath | Filter | Filter |
|---|---|---|
| /etc/ssh/sshd_config | oval:ssg-symlink_file_owner_sshd_config_uid_0:ste:1 | oval:ssg-state_file_owner_sshd_config_uid_0_0:ste:1 |